CVE-2025-54484: 
Linux Debian vulnerability analysis and mitigation

A stack-based buffer overflow vulnerability exists in the MFER parsing functionality of The Biosig Project libbiosig 3.9.0 and Master Branch (35a819fa). The vulnerability was discovered and disclosed on August 25, 2025, and affects the MFER (Medical waveform Format Encoding Rules) file parsing capabilities of the software (Talos, NVD).

The vulnerability manifests on line 8779 of biosig.c on the current master branch (35a819fa), when the Tag is 6. When processing MFER files with Tag 6 ("number of sequences"), the code fails to properly validate the length parameter before performing a buffer read operation. The vulnerability has been assigned a CVSS v3.1 Base Score of 9.8 CRITICAL (Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) and is classified as CWE-121: Stack-based Buffer Overflow (Talos).

A specially crafted MFER file can lead to arbitrary code execution. An attacker can provide a malicious file to trigger this vulnerability, potentially resulting in the ability to write arbitrary data past the end of a stack-allocated buffer (Talos).

The vulnerability affects The Biosig Project libbiosig 3.9.0 and Master Branch (35a819fa). Users should update to version 3.9.1 or later when available (NVD).