CVE-2025-66046: 
Linux Debian vulnerability analysis and mitigation

CVE-2025-66046 is a stack-based buffer overflow vulnerability in the MFER parsing functionality of The Biosig Project libbiosig 3.9.1. It is one of six related vulnerabilities (CVE-2025-66043 through CVE-2025-66048) discovered by Cisco Talos researchers Mark Bereza and Lilith in the same code area. A specially crafted MFER file can trigger arbitrary code execution when processed by the library. The vulnerability was disclosed on December 11, 2025, with a vendor patch already released on December 10, 2025. It carries a CVSS v3.1 base score of 9.8 (Critical) (Talos Advisory, Red Hat CVE).

The vulnerability is classified as CWE-121 (Stack-based Buffer Overflow) and CWE-787 (Out-of-bounds Write). It manifests in the sopen_extended function in biosig4c++/biosig.c at line 9203, specifically in the Tag 67 (0x43, "Sample skew") handling branch of the MFER file parser. In this branch, a small integer variable skew is declared on the stack, and ifread (a wrapper for fread) is called to read len bytes from the attacker-controlled file directly into &skew without bounds checking — because skew is only 4 bytes (an int), even small values of len exceeding 4 can trigger the overflow. The attacker-controlled data written past the end of the stack buffer can overwrite adjacent stack memory, including return addresses, enabling arbitrary code execution (Talos Advisory).

Successful exploitation allows an attacker to achieve arbitrary code execution on any system that processes a malicious MFER file using libbiosig 3.9.1. Because the vulnerability requires no authentication, no prior privileges, and no user interaction beyond file processing, the full confidentiality, integrity, and availability of the affected system are at risk. Libbiosig is used as the core of biosig APIs in Octave, MATLAB, SigViewer, and other biomedical signal processing software, meaning exploitation could affect medical research and clinical environments that rely on these tools (Talos Advisory).

A proof-of-concept exploit is publicly referenced via the Cisco Talos advisory, which includes detailed crash information and AddressSanitizer output demonstrating the overflow. There is no current evidence of in-the-wild exploitation. The EPSS score is approximately 0.078% (0.000780), indicating low but non-zero probability of exploitation in the near term. The vulnerability is not currently listed in the CISA Known Exploited Vulnerabilities (KEV) catalog (Talos Advisory, Red Hat CVE).

1. Craft a malicious MFER file: Create a file beginning with the magic bytes @ MFER or @ MFR to pass libbiosig's file type detection. Include a Tag 67 (0x43) frame with a length field (len) encoded to be greater than 4 bytes (the size of the int skew variable on the stack).
2. Encode an oversized length: Use multi-octet length encoding in the MFER frame to specify a len value significantly larger than 4, ensuring the subsequent ifread call will write attacker-controlled data well past the end of skew on the stack.
3. Populate the payload data: Fill the bytes following the length field with a crafted payload — padding to reach the saved return address on the stack, followed by a target address or ROP chain to redirect execution.
4. Deliver the file: Provide the malicious MFER file to any application that uses libbiosig for file parsing (e.g., SigViewer, Octave/MATLAB biosig API). This can be done via file upload interfaces, shared directories, or any network-accessible service that processes MFER files.
5. Trigger parsing: When the application calls sopen_extended on the malicious file, the Tag 67 branch executes ifread(&skew, 1, len, hdr), overflowing the stack buffer and redirecting execution to the attacker's payload (Talos Advisory).

• File System: Presence of unexpected or externally sourced .mfer or .mfr files in directories processed by libbiosig-based applications; new or modified files in application directories following MFER file processing.
• Process: Unusual child processes spawned by biomedical signal processing applications (e.g., SigViewer, Octave, MATLAB) such as shells (/bin/bash, cmd.exe), network utilities (curl, wget, nc), or other unexpected executables.
• Logs: Application crash logs or core dumps referencing sopen_extended in biosig.c around line 9203; AddressSanitizer output indicating stack-buffer-overflow in fread called from sopen_extended.
• Network: Unexpected outbound connections from systems running libbiosig-based applications following MFER file processing, particularly to unknown external IP addresses (Talos Advisory).

The vendor released a patch on December 10, 2025 — one day before public disclosure. Users should upgrade libbiosig to version 3.9.2 or later immediately. As interim mitigations, restrict processing of MFER files to trusted sources only, implement network segmentation around systems running libbiosig-based applications, and avoid exposing file-processing interfaces to untrusted input. Organizations should inventory all systems and applications using libbiosig 3.9.1, including Octave/MATLAB biosig APIs and SigViewer (Talos Advisory, Red Hat CVE).

Cisco Talos published a detailed technical advisory (TALOS-2025-2296) covering all six related vulnerabilities, crediting researchers Mark Bereza and Lilith. Red Hat tracked the CVE and assigned it a status entry. CISA included the vulnerability in its weekly bulletin (SB25-349). Community aggregators including Vulners, VulDB, CIRCL, and CVEFeed indexed the vulnerability shortly after disclosure, and it received brief mentions on social platforms including Bluesky and Mastodon (Talos Advisory, Red Hat CVE).