CVE-2025-64736: 
Linux Debian vulnerability analysis and mitigation

CVE-2025-64736 is an out-of-bounds read vulnerability in the ABF (Axon Binary File) parsing functionality of The Biosig Project libbiosig, an open-source library for processing medical signal data (EKG, EEG, etc.). Affected versions include libbiosig 3.9.2 and the Master Branch at commit 5462afb0. The vulnerability was disclosed to the vendor on January 12, 2026, patched on February 15, 2026, and publicly released on March 3, 2026. It carries a CVSSv3.1 base score of 6.1 (Medium) per Cisco Talos (Talos Advisory, Red Hat CVE).

The vulnerability (CWE-125: Out-of-bounds Read) resides in the sopen_abf_read function within biosig4c++/t210/sopen_abf_read.c. During ABF v1 file parsing, the code reads a signed 16-bit integer (nss) from the attacker-controlled nADCSamplingSeq array in the file header and uses it as an index into the sADCChannelName array (which has only 16 valid entries, ABF_ADCCOUNT=16) without bounds checking. Because nss is derived directly from file content, an attacker can supply a value far exceeding 16, causing a strncpy call to read 10 bytes from an address well beyond the bounds of the heap-allocated header buffer (hdr->AS.Header), ultimately resulting in a segfault or information disclosure. The source address for the out-of-bounds read is fully attacker-controlled, and the attacker can also influence the destination by padding the file with benign channels (Talos Advisory).

Successful exploitation results in an information leak, as heap memory contents beyond the sADCChannelName array boundary are copied into the channel label field and may be exposed to the calling application. In the worst case, the out-of-bounds read causes a segmentation fault (SIGSEGV), crashing any application that uses libbiosig to process the malicious file, resulting in a denial of service. The vulnerability primarily affects confidentiality (high) and availability (low to high depending on scoring source), with no integrity impact. Applications at risk include scientific and biomedical tools built on libbiosig, such as sigviewer and biosig APIs for Octave and MATLAB (Talos Advisory).

A proof-of-concept (PoC) exploit file is publicly available via the Cisco Talos advisory (TALOS-2025-2323), published on March 3, 2026. Exploitation requires user interaction — a local user must open a specially crafted .abf file with an application using the vulnerable libbiosig library. There is no evidence of in-the-wild exploitation at this time. The EPSS score is approximately 0.013% (0.000130), indicating a very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog (Talos Advisory).

1. Craft a malicious ABF file: Create a file beginning with the magic bytes ABF (4 bytes) to be recognized as an ABF v1 file by libbiosig's getfiletype function.
2. Set a large nADCSamplingSeq value: In the ABFFileHeader structure within the file, set one or more entries of the nADCSamplingSeq array to a large positive signed 16-bit integer (e.g., 0x2020) that exceeds the valid range of 0–15 (ABF_ADCCOUNT - 1).
3. Optionally pad with benign channels: Add one or more valid ADC channels before the malicious one to control which CHANNEL_TYPE entry in hdr->CHANNEL receives the out-of-bounds data, influencing the destination of the strncpy call.
4. Deliver the file to the target: Provide the crafted .abf file to a user or system running an application that uses libbiosig (e.g., sigviewer, a MATLAB/Octave biosig script) and induce them to open it.
5. Trigger the vulnerability: When libbiosig calls sopen_abf_read, it reads the attacker-controlled nss value and passes an out-of-bounds source address to strncpy, reading heap memory beyond the allocated header buffer — resulting in either information disclosure or a crash (SIGSEGV) (Talos Advisory).

• File System: Presence of unexpected or suspicious .abf files in user download directories, email attachments, or shared storage locations; files with ABF magic bytes but anomalous header content (e.g., nADCSamplingSeq values > 15).
• Process: Crash reports or core dumps from applications using libbiosig (e.g., sigviewer, MATLAB/Octave processes) with stack traces referencing sopen_abf_read and __strncpy_evex; SIGSEGV signals originating from libbiosig's ABF parsing code path.
• Logs: Application error logs showing segmentation faults or unexpected termination when opening .abf files; system crash logs (/var/log/syslog, dmesg) referencing the affected process crashing during file I/O.

The vendor released a patch on February 15, 2026; users should update libbiosig to a version newer than 3.9.2 / Master Branch commit 5462afb0. Until a patched version is applied, restrict user access to untrusted .abf files and educate users to avoid opening files from unknown sources. Consider implementing file validation or sandboxing mechanisms to reject or isolate potentially malicious .abf files before they are processed by libbiosig-based applications. Monitor systems running the affected versions for unexpected crashes in biosig-related processes (Talos Advisory).

The vulnerability was discovered by Mark Bereza of Cisco Talos and reported through coordinated disclosure. Talos published the full technical advisory (TALOS-2025-2323) on March 3, 2026, including detailed root cause analysis and GDB-based crash reproduction. The vulnerability was also indexed by Tenable (Nessus plugin 300631) and tracked by ENISA's EUVD database (EUVD-2025-208232). No significant broader media coverage or notable community debate has been observed beyond standard vulnerability tracking platforms (Talos Advisory, Tenable Plugin).