Cyber Posture

CVE-2025-54491

CriticalPublic PoC

Published: 25 August 2025

Published
25 August 2025
Modified
03 November 2025
KEV Added
Patch
CVSS Score 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS Score 0.0033 55.9th percentile
Risk Priority 20 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2025-54491 is a critical-severity Stack-based Buffer Overflow (CWE-121) vulnerability in Libbiosig Project Libbiosig. Its CVSS base score is 9.8 (Critical).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked in the top 44.1% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.

The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-16 (Memory Protection).

Threat & Defense at a Glance

What attackers do: exploitation maps to Exploit Public-Facing Application (T1190). What defenders deploy: see the NIST 800-53 controls recommended below.
Threat & Defense Details

Mitigating Controls (NIST 800-53 r5)AI

prevent

Directly requires timely remediation of known flaws like this stack-based buffer overflow through patching libbiosig.

prevent

Implements memory protections such as stack canaries and ASLR to prevent arbitrary code execution from stack buffer overflows.

prevent

Mandates validation of untrusted MFER file inputs to ensure lengths do not exceed buffer capacities, preventing the overflow.

MITRE ATT&CK Enterprise TechniquesAI

T1190 Exploit Public-Facing Application Initial Access
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
Why these techniques?

Stack-based buffer overflow in file parsing library enables remote unauthenticated arbitrary code execution via malicious MFER input with no user interaction, directly mapping to exploitation of a reachable application.

Confidence: HIGH · MITRE ATT&CK Enterprise v18.1

NVD Description

A stack-based buffer overflow vulnerability exists in the MFER parsing functionality of The Biosig Project libbiosig 3.9.0 and Master Branch (35a819fa). A specially crafted MFER file can lead to arbitrary code execution. An attacker can provide a malicious file to…

more

trigger this vulnerability.This vulnerability manifests on line 9191 of biosig.c on the current master branch (35a819fa), when the Tag is 65: else if (tag==65) //0x41: patient event { // event table curPos += ifread(buf,1,len,hdr);

Deeper analysisAI

CVE-2025-54491 is a stack-based buffer overflow vulnerability in the MFER parsing functionality of The Biosig Project's libbiosig version 3.9.0 and the master branch at commit 35a819fa. The issue arises when processing a specially crafted MFER file, specifically on line 9191 of biosig.c during handling of tag 65 (patient event), where the code executes `curPos += ifread(buf,1,len,hdr);` without sufficient bounds checking. This flaw, classified under CWE-121, carries a CVSS v3.1 base score of 9.8, reflecting its critical severity.

An unauthenticated attacker can exploit this vulnerability remotely with low complexity and no user interaction required, by providing a malicious MFER file to an application using the affected libbiosig library. Successful exploitation leads to arbitrary code execution, potentially granting full control over the affected system with high impacts to confidentiality, integrity, and availability.

The primary advisory is detailed in the Talos Intelligence report TALOS-2025-2234, available at https://talosintelligence.com/vulnerability_reports/TALOS-2025-2234. Practitioners should consult this source for guidance on mitigation strategies and patch availability.

Details

CWE(s)

Affected Products

libbiosig project
libbiosig
≤ 3.9.1

CVEs Like This One

CVE-2025-54486Same product: Libbiosig Project Libbiosig
CVE-2025-54492Same product: Libbiosig Project Libbiosig
CVE-2025-54489Same product: Libbiosig Project Libbiosig
CVE-2025-54490Same product: Libbiosig Project Libbiosig
CVE-2025-54488Same product: Libbiosig Project Libbiosig
CVE-2025-54494Same product: Libbiosig Project Libbiosig
CVE-2025-54485Same product: Libbiosig Project Libbiosig
CVE-2025-66045Same product: Libbiosig Project Libbiosig
CVE-2025-54482Same product: Libbiosig Project Libbiosig
CVE-2025-54493Same product: Libbiosig Project Libbiosig

References