CVE-2025-66043
Published: 11 December 2025
Description
Several stack-based buffer overflow vulnerabilities exists in the MFER parsing functionality of The Biosig Project libbiosig 3.9.1. A specially crafted MFER file can lead to arbitrary code execution. An attacker can provide a malicious file to trigger these vulnerabilities.When Tag…
more
is 3
Mitigating Controls (NIST 800-53 r5)AI
SI-2 requires timely identification, reporting, and patching of flaws like the stack-based buffer overflow in libbiosig's MFER parsing, directly eliminating the vulnerability.
SI-10 mandates validation of information inputs such as MFER files at the parsing stage to reject specially crafted files that trigger the buffer overflow when Tag is 3.
SI-16 enforces memory protections like stack canaries and ASLR to mitigate arbitrary code execution from the stack-based buffer overflow even if unpatched.
Security SummaryAI
CVE-2025-66043 involves several stack-based buffer overflow vulnerabilities (CWE-121 and CWE-787) in the MFER parsing functionality of The Biosig Project's libbiosig version 3.9.1. These flaws, which manifest when Tag is 3, can be triggered by a specially crafted MFER file, potentially leading to arbitrary code execution.
The vulnerability carries a CVSS v3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), marking it as critical due to its network accessibility, low complexity, lack of required privileges or user interaction, and high impacts across confidentiality, integrity, and availability. Any unauthenticated attacker capable of supplying a malicious MFER file to an application that uses the affected library for parsing can exploit it to achieve arbitrary code execution.
Mitigation guidance is available in the Talos Intelligence advisory at https://talosintelligence.com/vulnerability_reports/TALOS-2025-2296.
Details
- CWE(s)
Affected Products
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
The vulnerability enables arbitrary code execution via a specially crafted MFER file with network accessibility (AV:N), no privileges (PR:N), and no user interaction (UI:N), directly facilitating exploitation of public-facing applications that parse such files.