CVE-2025-66046
Published: 11 December 2025
Summary
CVE-2025-66046 is a critical-severity Stack-based Buffer Overflow (CWE-121) vulnerability in Libbiosig Project Libbiosig. Its CVSS base score is 9.8 (Critical).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 31.8th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified are NIST 800-53 SI-16 (Memory Protection) and SI-2 (Flaw Remediation).
Threat & Defense at a Glance
Threat & Defense Details
Mitigating Controls (NIST 800-53 r5)AI
Directly mitigates the stack-based buffer overflow in libbiosig by requiring timely remediation through patching or upgrading to a non-vulnerable version.
Implements memory protections such as stack canaries, ASLR, and DEP to prevent arbitrary code execution from stack buffer overflows during MFER parsing.
Requires validation of MFER file inputs before parsing to reject specially crafted files that trigger the Tag 67 buffer overflow vulnerability.
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Remote (AV:N), unauthenticated (PR:N), no-interaction (UI:N) buffer overflow enabling arbitrary code execution via malicious MFER file directly facilitates exploitation of public-facing applications.
NVD Description
Several stack-based buffer overflow vulnerabilities exists in the MFER parsing functionality of The Biosig Project libbiosig 3.9.1. A specially crafted MFER file can lead to arbitrary code execution. An attacker can provide a malicious file to trigger these vulnerabilities.When Tag…
more
is 67
Deeper analysisAI
CVE-2025-66046 involves several stack-based buffer overflow vulnerabilities (CWE-121, CWE-787) in the MFER parsing functionality of The Biosig Project's libbiosig version 3.9.1. These flaws occur specifically when processing Tag 67 in a specially crafted MFER file, which can trigger arbitrary code execution. The vulnerability carries a CVSS v3.1 base score of 9.8, reflecting its critical severity due to network accessibility, low attack complexity, and lack of prerequisites.
An unauthenticated attacker (PR:N) can exploit this remotely (AV:N) with low complexity (AC:L) and no user interaction (UI:N), by providing a malicious MFER file to an application using the affected libbiosig library. Successful exploitation leads to high-impact arbitrary code execution, compromising confidentiality (C:H), integrity (I:H), and availability (A:H) within the unchanged security scope (S:U).
Mitigation details are outlined in the Talos Intelligence advisory at https://talosintelligence.com/vulnerability_reports/TALOS-2025-2296.
Details
- CWE(s)