Cyber Posture

CVE-2025-54488

CriticalPublic PoC

Published: 25 August 2025

Published
25 August 2025
Modified
03 November 2025
KEV Added
Patch
CVSS Score 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS Score 0.0033 55.9th percentile
Risk Priority 20 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2025-54488 is a critical-severity Stack-based Buffer Overflow (CWE-121) vulnerability in Libbiosig Project Libbiosig. Its CVSS base score is 9.8 (Critical).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked in the top 44.1% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.

The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-16 (Memory Protection).

Threat & Defense at a Glance

What attackers do: exploitation maps to Exploit Public-Facing Application (T1190). What defenders deploy: see the NIST 800-53 controls recommended below.
Threat & Defense Details

Mitigating Controls (NIST 800-53 r5)AI

prevent

Requires validation of MFER file inputs, including length checks for tag 13 data, to prevent stack buffer overflows from specially crafted files.

prevent

Implements memory protections such as stack canaries and DEP to block exploitation of the stack-based buffer overflow leading to arbitrary code execution.

prevent

Mandates timely remediation of the known buffer overflow flaw in libbiosig by applying patches or upgrades to version 3.9.0 and master branch.

MITRE ATT&CK Enterprise TechniquesAI

T1190 Exploit Public-Facing Application Initial Access
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
Why these techniques?

Remote unauthenticated stack buffer overflow enabling arbitrary code execution via crafted MFER file input directly maps to exploitation of a public-facing application or service performing file parsing.

Confidence: HIGH · MITRE ATT&CK Enterprise v18.1

NVD Description

A stack-based buffer overflow vulnerability exists in the MFER parsing functionality of The Biosig Project libbiosig 3.9.0 and Master Branch (35a819fa). A specially crafted MFER file can lead to arbitrary code execution. An attacker can provide a malicious file to…

more

trigger this vulnerability.This vulnerability manifests on line 8850 of biosig.c on the current master branch (35a819fa), when the Tag is 13: else if (tag==13) { if (len>8) fprintf(stderr,"Warning MFER tag13 incorrect length %i>8\n",len); curPos += ifread(&buf,1,len,hdr);

Deeper analysisAI

A stack-based buffer overflow vulnerability, tracked as CVE-2025-54488 and published on 2025-08-25, affects the MFER parsing functionality in The Biosig Project's libbiosig version 3.9.0 and the master branch at commit 35a819fa. The issue arises in biosig.c at line 8850 during handling of MFER tag 13, where a specially crafted MFER file can overflow the buffer allocated for reading data, as indicated by the code snippet that reads 'len' bytes into 'buf' without sufficient bounds checking, even while warning about lengths exceeding 8 bytes. This vulnerability is classified under CWE-121 and carries a CVSS v3.1 base score of 9.8.

The vulnerability enables arbitrary code execution and can be exploited remotely by any unauthenticated attacker with network access, requiring low complexity and no user interaction (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H). An attacker simply needs to provide a malicious MFER file to an application or system using the affected libbiosig parsing routines, triggering the overflow during file processing.

Advisories are available from Talos Intelligence at https://talosintelligence.com/vulnerability_reports/TALOS-2025-2234 and https://www.talosintelligence.com/vulnerability_reports/TALOS-2025-2234.

Details

CWE(s)

Affected Products

libbiosig project
libbiosig
≤ 3.9.1

CVEs Like This One

CVE-2025-54486Same product: Libbiosig Project Libbiosig
CVE-2025-54491Same product: Libbiosig Project Libbiosig
CVE-2025-54492Same product: Libbiosig Project Libbiosig
CVE-2025-54489Same product: Libbiosig Project Libbiosig
CVE-2025-54490Same product: Libbiosig Project Libbiosig
CVE-2025-54494Same product: Libbiosig Project Libbiosig
CVE-2025-54485Same product: Libbiosig Project Libbiosig
CVE-2025-66045Same product: Libbiosig Project Libbiosig
CVE-2025-54482Same product: Libbiosig Project Libbiosig
CVE-2025-54493Same product: Libbiosig Project Libbiosig

References