CVE-2025-66048
Published: 11 December 2025
Summary
CVE-2025-66048 is a critical-severity Stack-based Buffer Overflow (CWE-121) vulnerability in Libbiosig Project Libbiosig. Its CVSS base score is 9.8 (Critical).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploitation for Client Execution (T1203); ranked at the 35.8th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-16 (Memory Protection).
Deeper analysis
CVE-2025-66048 involves several stack-based buffer overflow vulnerabilities (CWE-121 and CWE-787) in the MFER parsing functionality of The Biosig Project's libbiosig version 3.9.1. These issues arise when processing a specially crafted MFER file, particularly when Tag is 133, enabling arbitrary code execution.
The vulnerability carries a CVSS v3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), making it remotely exploitable with low attack complexity, no required privileges, and no user interaction. An attacker can provide a malicious MFER file to any application or system that parses MFER files using the affected libbiosig library, potentially achieving arbitrary code execution with high impact on confidentiality, integrity, and availability.
Mitigation guidance is available in the Talos Intelligence advisory at https://talosintelligence.com/vulnerability_reports/TALOS-2025-2296.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-202759
Vulnerability details
Several stack-based buffer overflow vulnerabilities exists in the MFER parsing functionality of The Biosig Project libbiosig 3.9.1. A specially crafted MFER file can lead to arbitrary code execution. An attacker can provide a malicious file to trigger these vulnerabilities.When Tag…
more
is 133
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Stack-based buffer overflow in MFER parsing enables arbitrary code execution via crafted file with no user interaction, directly facilitating Exploitation for Client Execution.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly mitigates the buffer overflow vulnerability by requiring timely application of patches or updates to libbiosig as advised in the Talos Intelligence advisory.
Requires validation of MFER file inputs, including bounds checking during parsing of Tag 133, to prevent stack-based buffer overflows from specially crafted files.
Implements memory protections such as stack canaries, ASLR, and non-executable stacks to block arbitrary code execution from stack buffer overflows in libbiosig.