CVE-2025-66046
BaseFortify
Publication date: 2025-12-11
Last updated on: 2025-12-17
Assigner: Talos
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| libbiosig_project | libbiosig | to 3.9.2 (exc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-787 | The product writes data past the end, or before the beginning, of the intended buffer. |
| CWE-121 | A stack-based buffer overflow condition is a condition where the buffer being overwritten is allocated on the stack (i.e., is a local variable or, rarely, a parameter to a function). |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability involves several stack-based buffer overflow issues in the MFER parsing functionality of The Biosig Project libbiosig version 3.9.1. When processing a specially crafted MFER file with Tag 67, these vulnerabilities can be triggered, potentially allowing an attacker to execute arbitrary code by providing a malicious file.
How can this vulnerability impact me? :
The vulnerability can lead to arbitrary code execution on the affected system without requiring any privileges or user interaction. This means an attacker could take full control of the system, potentially leading to data loss, system compromise, or further attacks.
How can this vulnerability be detected on my network or system? Can you suggest some commands?
Detection involves identifying the presence of libbiosig version 3.9.1 on your system and monitoring for processing of maliciously crafted MFER files, especially those containing Tag 3 TLV frames with length fields exceeding 17 bytes. Since the vulnerability is triggered by parsing such files, you can scan for MFER files with suspiciously large length fields in Tag 3. Specific commands are not provided in the resources, but you can use file inspection tools or write scripts to parse MFER files and check the length fields of Tag 3 TLV frames. Additionally, monitoring application logs or using AddressSanitizer during testing can help detect exploitation attempts. [1]
What immediate steps should I take to mitigate this vulnerability?
Immediate mitigation steps include avoiding the use of libbiosig version 3.9.1 for processing untrusted MFER files, especially those containing Tag 3 TLV frames. If possible, update to a patched version of libbiosig once available. In the meantime, restrict or validate input files to ensure they do not contain maliciously crafted MFER files with length fields exceeding safe limits. Employ application-level input validation and consider sandboxing or isolating processes that handle MFER files to limit potential impact. [1]
How can this vulnerability be detected on my network or system? Can you suggest some commands?
Detection involves identifying the presence of libbiosig version 3.9.1 and monitoring or scanning for malicious MFER files with malformed Tag 3 TLV frames that have length fields exceeding 16 bytes. Since the vulnerability is triggered by processing specially crafted MFER files, you can detect attempts by scanning for such files or monitoring applications that use libbiosig for suspicious file inputs. Specific commands are not provided in the resources, but you could use file scanning tools or custom scripts to parse MFER files and check for Tag 3 entries with length fields greater than 16 bytes. Additionally, monitoring application logs for crashes or AddressSanitizer reports related to libbiosig could help detect exploitation attempts. [1]
What immediate steps should I take to mitigate this vulnerability?
Immediate mitigation steps include preventing the processing of untrusted or unauthenticated MFER files, especially those with Tag 3 TLV frames that have length fields exceeding 16 bytes. If possible, update or patch libbiosig to a version where this vulnerability is fixed. If no patch is available, consider disabling or restricting the use of libbiosig 3.9.1 in your environment, or applying input validation to reject malformed MFER files before parsing. Monitoring for suspicious activity and applying network-level controls to block malicious file transfers can also help mitigate risk. [1]