CVE-2025-54490: Buffer Overflow
A stack-based buffer overflow vulnerability exists in the MFER parsing functionality of The Biosig Project libbiosig 3.9.0 and Master Branch (35a819fa). A specially crafted MFER file can lead to arbitrary code execution. An attacker can provide a malicious file to trigger this vulnerability.This vulnerability manifests on line 9090 of biosig.c on the current master branch (35a819fa), when the Tag is 64: else if (tag==64) //0x40 { // preamble char tmp[256]; // [1] curPos += ifread(tmp,1,len,hdr); In this case, the overflowed buffer is the newly-declared tmp \[1\] instead of buf. While tmp is larger than buf, having a size of 256 bytes, a stack overflow can still occur in cases where len is encoded using multiple octets and is greater than 256.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2025-54490?
CVE-2025-54490 is classified as a critical vulnerability due to its potential for arbitrary code execution.
How do I fix CVE-2025-54490?
To fix CVE-2025-54490, update The Biosig Project libbiosig to version 3.9.1 or later where the vulnerability has been addressed.
Who is affected by CVE-2025-54490?
CVE-2025-54490 affects users of The Biosig Project libbiosig version 3.9.0 and the Master Branch prior to a security fix.
What is the impact of exploiting CVE-2025-54490?
Exploiting CVE-2025-54490 allows an attacker to execute arbitrary code on the affected system through a specially crafted MFER file.
How can I detect if CVE-2025-54490 is present in my system?
You can detect CVE-2025-54490 by checking if you are using The Biosig Project libbiosig version 3.9.0 and testing any parsing of MFER files for vulnerabilities.