CVE-2025-66044
Published: 11 December 2025
Summary
CVE-2025-66044 is a critical-severity Stack-based Buffer Overflow (CWE-121) vulnerability in Libbiosig Project Libbiosig. Its CVSS base score is 9.8 (Critical).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 35.8th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-16 (Memory Protection).
Deeper analysis
CVE-2025-66044 involves several stack-based buffer overflow vulnerabilities (CWE-121 and CWE-787) in the MFER parsing functionality of The Biosig Project's libbiosig version 3.9.1. These issues arise when processing a specially crafted MFER file, particularly when the Tag value is 64, and can lead to arbitrary code execution.
The vulnerability carries a CVSS v3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), making it remotely exploitable over a network with low attack complexity, no required privileges or user interaction, and high impacts on confidentiality, integrity, and availability. Any attacker capable of providing a malicious MFER file to an application or system using the affected libbiosig version can trigger the overflows to achieve arbitrary code execution on the target.
Mitigation details are outlined in the Talos Intelligence advisory TALOS-2025-2296, available at https://talosintelligence.com/vulnerability_reports/TALOS-2025-2296.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-202763
Vulnerability details
Several stack-based buffer overflow vulnerabilities exists in the MFER parsing functionality of The Biosig Project libbiosig 3.9.1. A specially crafted MFER file can lead to arbitrary code execution. An attacker can provide a malicious file to trigger these vulnerabilities.When Tag…
more
is 64
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
The vulnerability enables remote arbitrary code execution (AV:N/AC:L/PR:N/UI:N) via a crafted MFER file in applications using libbiosig, directly mapping to exploitation of public-facing applications.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Flaw remediation directly mitigates the CVE by requiring timely patching of the buffer overflow vulnerability in libbiosig 3.9.1.
Information input validation prevents exploitation by ensuring proper validation of specially crafted MFER files during parsing, addressing the root cause of the stack-based buffer overflows.
Memory protection mechanisms like stack canaries, ASLR, and DEP directly mitigate stack-based buffer overflows by preventing arbitrary code execution even if overflows occur.