CVE-2025-66045
Published: 11 December 2025
Summary
CVE-2025-66045 is a critical-severity Stack-based Buffer Overflow (CWE-121) vulnerability in Libbiosig Project Libbiosig. Its CVSS base score is 9.8 (Critical).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 35.8th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-16 (Memory Protection).
Deeper analysis
CVE-2025-66045 involves several stack-based buffer overflow vulnerabilities (CWE-121 and CWE-787) in the MFER parsing functionality of The Biosig Project's libbiosig version 3.9.1. These flaws, specifically triggered when Tag is 65, can be exploited via a specially crafted MFER file, leading to arbitrary code execution.
The vulnerability carries a CVSS v3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), making it remotely exploitable over a network with low attack complexity, no required privileges, and no user interaction. Any attacker able to supply a malicious MFER file to a vulnerable application or system processing such files can achieve arbitrary code execution, resulting in high impacts to confidentiality, integrity, and availability.
Mitigation guidance is available in the Talos Intelligence advisory at https://talosintelligence.com/vulnerability_reports/TALOS-2025-2296.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-202762
Vulnerability details
Several stack-based buffer overflow vulnerabilities exists in the MFER parsing functionality of The Biosig Project libbiosig 3.9.1. A specially crafted MFER file can lead to arbitrary code execution. An attacker can provide a malicious file to trigger these vulnerabilities.When Tag…
more
is 65
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
The vulnerability enables remote unauthenticated arbitrary code execution (AV:N/AC:L/PR:N/UI:N) via a specially crafted MFER file processed by vulnerable applications, directly facilitating T1190: Exploit Public-Facing Application.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly remediates the stack-based buffer overflow flaws in libbiosig 3.9.1 MFER parsing by requiring timely patching or upgrading to a non-vulnerable version.
Mandates validation of MFER file inputs, including Tag 65 structures, to block specially crafted files from triggering buffer overflows.
Implements memory protection mechanisms like stack canaries and address space layout randomization to mitigate exploitation of stack-based buffer overflows in MFER parsing.