CVE-2025-66043
Published: 11 December 2025
Summary
CVE-2025-66043 is a critical-severity Stack-based Buffer Overflow (CWE-121) vulnerability in Libbiosig Project Libbiosig. Its CVSS base score is 9.8 (Critical).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 35.8th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).
Deeper analysis
CVE-2025-66043 involves several stack-based buffer overflow vulnerabilities (CWE-121 and CWE-787) in the MFER parsing functionality of The Biosig Project's libbiosig version 3.9.1. These flaws, which manifest when Tag is 3, can be triggered by a specially crafted MFER file, potentially leading to arbitrary code execution.
The vulnerability carries a CVSS v3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), marking it as critical due to its network accessibility, low complexity, lack of required privileges or user interaction, and high impacts across confidentiality, integrity, and availability. Any unauthenticated attacker capable of supplying a malicious MFER file to an application that uses the affected library for parsing can exploit it to achieve arbitrary code execution.
Mitigation guidance is available in the Talos Intelligence advisory at https://talosintelligence.com/vulnerability_reports/TALOS-2025-2296.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-202764
Vulnerability details
Several stack-based buffer overflow vulnerabilities exists in the MFER parsing functionality of The Biosig Project libbiosig 3.9.1. A specially crafted MFER file can lead to arbitrary code execution. An attacker can provide a malicious file to trigger these vulnerabilities.When Tag…
more
is 3
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
The vulnerability enables arbitrary code execution via a specially crafted MFER file with network accessibility (AV:N), no privileges (PR:N), and no user interaction (UI:N), directly facilitating exploitation of public-facing applications that parse such files.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
SI-2 requires timely identification, reporting, and patching of flaws like the stack-based buffer overflow in libbiosig's MFER parsing, directly eliminating the vulnerability.
SI-10 mandates validation of information inputs such as MFER files at the parsing stage to reject specially crafted files that trigger the buffer overflow when Tag is 3.
SI-16 enforces memory protections like stack canaries and ASLR to mitigate arbitrary code execution from the stack-based buffer overflow even if unpatched.