CVE-2025-66045: 
Linux Debian vulnerability analysis and mitigation

CVE-2025-66045 is a stack-based buffer overflow vulnerability in the MFER parsing functionality of The Biosig Project libbiosig version 3.9.1. It is one of six related vulnerabilities (CVE-2025-66043 through CVE-2025-66048) discovered by Cisco Talos researchers Mark Bereza and Lilith >_> and disclosed on December 11, 2025. The vulnerability affects libbiosig versions prior to 3.9.2 and can be triggered by a specially crafted MFER file to achieve arbitrary code execution. It carries a CVSS v3.1 base score of 9.8 (Critical) (Talos Advisory, Red Hat CVE).

The vulnerability is classified as CWE-121 (Stack-based Buffer Overflow) and CWE-787 (Out-of-bounds Write). It manifests in biosig.c at line 9162 within the sopen_extended function, specifically in the MFER Tag 65 (0x41, patient event) parsing branch, where a call to ifread(buf, 1, len, hdr) reads attacker-controlled data into the statically-allocated 128-byte stack buffer buf without validating that len does not exceed the buffer's capacity. Because len is derived directly from the input file and no bounds check enforces the 128-byte limit before the read, an attacker can supply an MFER file encoding a length value larger than 128 to overflow the buffer with arbitrary data. The overflowed data is fully attacker-controlled, enabling potential control-flow hijacking and arbitrary code execution (Talos Advisory).

Successful exploitation allows an unauthenticated remote attacker to execute arbitrary code on the target system with the privileges of the process running libbiosig, resulting in complete compromise of confidentiality, integrity, and availability. Libbiosig is used as a core component in biomedical signal processing software including Octave/Matlab biosig APIs, SigViewer, and other scientific tools, meaning exploitation could affect medical research and clinical environments. Lateral movement and further system compromise are possible if the affected process runs with elevated privileges (Talos Advisory, Red Hat CVE).

A proof-of-concept exploit is publicly available via the Cisco Talos vulnerability report, which includes detailed crash information and AddressSanitizer output demonstrating the overflow (Talos Advisory). The vulnerability requires no authentication, no user interaction, and is network-accessible (CVSS AV:N), making it trivially exploitable by providing a malicious MFER file to any application that processes such files. The EPSS score is approximately 0.078% (0.000780), indicating currently low observed exploitation probability. There is no evidence of in-the-wild exploitation at this time, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog (Feedly).

1. Reconnaissance: Identify systems or services that use libbiosig 3.9.1 for processing medical waveform files (e.g., applications using biosig APIs in Octave/Matlab, SigViewer, or custom biomedical signal processing tools).
2. Craft malicious MFER file: Create an MFER file with a valid magic byte header (@ MFER or @ MFR ) to pass the file type detection check in getfiletype.
3. Set Tag 65 with oversized length: In the MFER file structure, encode a Tag value of 65 (0x41, patient event) followed by a length field (len) encoded to exceed 128 bytes (e.g., using multi-octet length encoding to specify a value such as 256 or larger).
4. Embed payload data: Fill the data portion of the Tag 65 frame with attacker-controlled bytes designed to overwrite the stack return address or function pointers beyond the 128-byte buf buffer in sopen_extended.
5. Deliver the file: Submit the crafted MFER file to the target application — either directly (e.g., via file upload interface) or by placing it in a location the application will process automatically.
6. Trigger code execution: When sopen_extended processes the Tag 65 frame, ifread(buf, 1, len, hdr) reads the oversized payload into the stack buffer, overflowing it and overwriting the return address with attacker-controlled data, redirecting execution to a shellcode or ROP chain (Talos Advisory).

• File System: Presence of MFER files (magic bytes @ MFER or @ MFR at offset 0) with anomalously large Tag 65 length fields; unexpected MFER files in upload directories or temporary processing folders.
• Logs: Application crash logs or core dumps referencing sopen_extended in biosig.c; AddressSanitizer output indicating stack-buffer-overflow at biosig.c:9162; stderr messages such as unexpected MFER parsing warnings from libbiosig.
• Process: Unexpected child processes spawned by biomedical signal processing applications (e.g., shells, network utilities); abnormal process termination or segmentation faults in applications linked against libbiosig.
• Network: Unusual file transfers delivering MFER-formatted data to systems running libbiosig-based applications; outbound connections from biomedical processing servers to unknown external hosts following MFER file processing events (Talos Advisory).

The vendor released libbiosig version 3.9.2 on December 10, 2025 (same day as vendor disclosure), which addresses all six MFER parsing buffer overflow vulnerabilities including CVE-2025-66045. Users should upgrade to libbiosig 3.9.2 or later immediately. As interim mitigations where patching is not immediately possible: implement strict input validation for MFER files before processing, use network segmentation to restrict access to systems running libbiosig, and consider temporarily disabling MFER file processing. Monitor systems for unexpected file processing behavior or crashes (Talos Advisory, Red Hat CVE).

Cisco Talos publicly disclosed the vulnerability on December 11, 2025, one day after coordinated vendor disclosure and patch release, following responsible disclosure practices. The CISA Vulnerability Bulletin (SB25-349) included CVE-2025-66045 in its weekly summary, indicating recognition by the U.S. cybersecurity authority (CISA Bulletin). The Talos report was noted in security community feeds including infosec.place and various vulnerability tracking platforms, though broader social media discussion has been limited given the specialized nature of the affected library.