CVE-2025-54481

A stack-based buffer overflow vulnerability exists in the MFER parsing functionality of The Biosig Project libbiosig 3.9.0 and Master Branch (35a819fa). A specially crafted MFER file can lead to arbitrary code execution. An attacker can provide a malicious file to trigger this vulnerability.This vulnerability manifests on line 8744 of biosig.c on the current master branch (35a819fa), when the Tag is 3: else if (tag==3) { // character code char v[17]; // [1] if (len>16) fprintf(stderr,"Warning MFER tag2 incorrect length %i>16\n",len); curPos += ifread(&v,1,len,hdr); v[len] = 0; In this case, the overflowed buffer is the newly-declared `v` \[1\] instead of `buf`. Since `v` is only 17 bytes large, much smaller values of `len` (even those encoded using a single octet) can trigger an overflow in this code path.

CVSS v3 9.8 CRITICAL

9.8^/10

CVSS v3 : CRITICAL

Vector :

Exploitability : 3.9 / Impact : 5.9

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://talosintelligence.com/vulnerability_reports/TALOS-2025-2234	Exploit Third Party Advisory
https://www.talosintelligence.com/vulnerability_reports/TALOS-2025-2234

Configurations

Configuration 1 (hide)

cpe:2.3:a:libbiosig_project:libbiosig:*:*:*:*:*:*:*:*

History

03 Nov 2025, 19:16

Type	Values Removed	Values Added
References		() https://www.talosintelligence.com/vulnerability_reports/TALOS-2025-2234 -

Information

Published : 2025-08-25 14:15

Updated : 2025-11-03 19:16

NVD link : CVE-2025-54481

Mitre link : CVE-2025-54481

CVE.ORG link : CVE-2025-54481

JSON object : View

Products Affected

libbiosig_project

libbiosig

CWE

CWE-121

Stack-based Buffer Overflow

{"id": "CVE-2025-54481", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Secondary", "source": "[email protected]", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 9.8, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 3.9}]}, "published": "2025-08-25T14:15:33.700", "references": [{"url": "https://talosintelligence.com/vulnerability_reports/TALOS-2025-2234", "tags": ["Exploit", "Third Party Advisory"], "source": "[email protected]"}, {"url": "https://www.talosintelligence.com/vulnerability_reports/TALOS-2025-2234", "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Secondary", "source": "[email protected]", "description": [{"lang": "en", "value": "CWE-121"}]}], "descriptions": [{"lang": "en", "value": "A stack-based buffer overflow vulnerability exists in the MFER parsing functionality of The Biosig Project libbiosig 3.9.0 and Master Branch (35a819fa). A specially crafted MFER file can lead to arbitrary code execution. An attacker can provide a malicious file to trigger this vulnerability.This vulnerability manifests on line 8744 of biosig.c on the current master branch (35a819fa), when the Tag is 3:\r\n\r\n\t\t\t\telse if (tag==3) {\r\n\t\t\t\t\t// character code\r\n\t\t\t\t\tchar v[17];\t\t// [1]\r\n\t\t\t\t\tif (len>16) fprintf(stderr,\"Warning MFER tag2 incorrect length %i>16\\n\",len);\r\n\t\t\t\t\tcurPos += ifread(&v,1,len,hdr);\r\n\t\t\t\t\tv[len] = 0;\r\n\r\nIn this case, the overflowed buffer is the newly-declared `v` \\[1\\] instead of `buf`. Since `v` is only 17 bytes large, much smaller values of `len` (even those encoded using a single octet) can trigger an overflow in this code path."}, {"lang": "es", "value": "Existe una vulnerabilidad de desbordamiento de b\u00fafer en la pila en la funcionalidad de an\u00e1lisis MFER de The Biosig Project libbiosig 3.9.0 y Master Branch (35a819fa). Un archivo MFER especialmente manipulado puede provocar la ejecuci\u00f3n de c\u00f3digo arbitrario. Un atacante puede proporcionar un archivo malicioso para activar esta vulnerabilidad. Esta vulnerabilidad se manifiesta en la l\u00ednea 8744 de biosig.c en la rama maestra actual (35a819fa), cuando la etiqueta es 3: else if (tag==3) { // character code char v[17]; // [1] if (len>16) fprintf(stderr,\"Warning MFER tag2 incorrect length %i>16\\n\",len); curPos += ifread(&v,1,len,hdr); v[len] = 0; En este caso, el b\u00fafer desbordado es el reci\u00e9n declarado `v` \\[1\\] en lugar de `buf`. Dado que `v` tiene solo 17 bytes, valores mucho m\u00e1s peque\u00f1os de `len` (incluso aquellos codificados utilizando un solo octeto) pueden provocar un desbordamiento en esta ruta de c\u00f3digo."}], "lastModified": "2025-11-03T19:16:09.930", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:libbiosig_project:libbiosig:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "4893D615-FD95-4393-A5B0-E1BE19F180A6", "versionEndExcluding": "3.9.1"}], "operator": "OR"}]}], "sourceIdentifier": "[email protected]"}