CVE-2025-66047: 
Linux Debian vulnerability analysis and mitigation

CVE-2025-66047 is a stack-based buffer overflow vulnerability in the MFER parsing functionality of The Biosig Project libbiosig 3.9.1. It is one of six related vulnerabilities (CVE-2025-66043 through CVE-2025-66048) discovered by Cisco Talos researchers Mark Bereza and Lilith in the same code area. A specially crafted MFER file can trigger the overflow, potentially leading to arbitrary code execution without authentication or user interaction. The vulnerability affects libbiosig versions prior to 3.9.2 and carries a CVSS v3.1 base score of 9.8 (Critical) (Talos Advisory, Red Hat CVE).

The vulnerability is classified as CWE-121 (Stack-based Buffer Overflow) and CWE-787 (Out-of-bounds Write). It manifests in biosig.c at line 9245 within the sopen_extended function, specifically when processing an MFER tag value of 131 (0x83, Patient Age). The code allocates a fixed 128-byte stack buffer (buf) but reads attacker-controlled len bytes from the file into it via ifread (a wrapper for fread) without enforcing the expected length of 7 bytes — only printing a warning message that does not halt execution. Because the data written past the buffer boundary originates directly from the attacker-supplied file, the overflow is fully attacker-controlled, enabling potential return address or stack variable corruption leading to arbitrary code execution (Talos Advisory).

Successful exploitation allows a remote, unauthenticated attacker to achieve arbitrary code execution on any system that processes a maliciously crafted MFER file using libbiosig. The impact is rated High across confidentiality, integrity, and availability, meaning a complete system compromise is possible. Since libbiosig underpins biosig APIs in Octave, MATLAB, SigViewer, and other biomedical signal processing tools, exploitation could affect clinical or research environments processing medical waveform data (ECG, EEG), potentially enabling lateral movement within those networks (Talos Advisory, Red Hat CVE).

A proof-of-concept exploit is publicly referenced via the Cisco Talos advisory (TALOS-2025-2296), but no evidence of active in-the-wild exploitation has been observed as of the time of disclosure. The vulnerability requires no authentication, no privileges, and no user interaction beyond the target application parsing a malicious MFER file, making it trivially exploitable in any context where untrusted files are processed. The EPSS score is approximately 0.078% (0.000780), indicating a currently low probability of exploitation in the wild. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog (Talos Advisory).

1. Reconnaissance: Identify systems or services that use libbiosig 3.9.1 for processing medical waveform files (e.g., applications built on biosig APIs for Octave/MATLAB, SigViewer, or custom biomedical signal processing pipelines).
2. Craft malicious MFER file: Create an MFER file with valid magic bytes (@ MFER or @ MFR ) to pass the file type detection check in getfiletype.
3. Set Tag 131 with oversized length: In the MFER file structure, encode a tag byte of 0x83 (131, Patient Age) followed by a length field encoding a value greater than 128 (e.g., 0x44 = 68 or larger), using multi-octet length encoding if needed.
4. Populate payload data: Fill the data section of the tag with attacker-controlled bytes designed to overwrite the stack return address or adjacent stack variables beyond the 128-byte buf buffer.
5. Deliver the file: Submit the crafted MFER file to the target application — via file upload, network share, API endpoint, or any other mechanism by which the application ingests MFER files for parsing.
6. Trigger code execution: When sopen_extended processes the file and reaches the Tag 131 branch, ifread writes the oversized payload into the fixed stack buffer, overflowing it with attacker-controlled data and potentially redirecting execution to attacker-supplied shellcode or a ROP chain (Talos Advisory).

• File System: Presence of unexpected or externally sourced .mfer or .mfr files in directories processed by libbiosig-based applications; newly created files or scripts in application working directories following file parsing events.
• Process: Unusual child processes spawned by biomedical signal processing applications (e.g., sigviewer, Octave, MATLAB biosig scripts) such as shells (/bin/bash, cmd.exe), network utilities (curl, wget, nc), or other unexpected executables.
• Logs: Application crash logs or core dumps referencing sopen_extended in biosig.c; AddressSanitizer output indicating stack-buffer-overflow at biosig.c:9245; warning messages matching Warning MFER tag131 incorrect length with unexpected length values in application stderr/logs.
• Network: Unexpected outbound connections from biomedical data processing servers to unknown external IP addresses following MFER file ingestion events.

The vendor released libbiosig version 3.9.2 on 2025-12-10 (the same day as vendor disclosure), which addresses CVE-2025-66047 and the five related MFER parsing vulnerabilities. Users should upgrade to libbiosig 3.9.2 or later immediately. As interim mitigations, restrict access to MFER file parsing functionality, implement strict input validation and allowlisting for accepted file types, apply network segmentation to limit exposure of systems running libbiosig-based applications, and monitor for suspicious file upload or parsing activities (Talos Advisory, Red Hat CVE).

The vulnerability was discovered and disclosed by Cisco Talos researchers Mark Bereza and Lilith, with coordinated vendor disclosure and patch release on 2025-12-10 followed by public release on 2025-12-11. The CISA Vulnerability Bulletin (SB25-349) referenced the CVE in its weekly summary. Red Hat tracked the vulnerability as affecting their ecosystem. Community aggregators including Vulners, VulDB, CIRCL, and CVEFeed.io indexed the vulnerability shortly after disclosure, and Tenable published a Nessus detection plugin (278397) (Talos Advisory, Red Hat CVE).