CVE-2025-54492: Buffer Overflow
A stack-based buffer overflow vulnerability exists in the MFER parsing functionality of The Biosig Project libbiosig 3.9.0 and Master Branch (35a819fa). A specially crafted MFER file can lead to arbitrary code execution. An attacker can provide a malicious file to trigger this vulnerability.This vulnerability manifests on line 9141 of biosig.c on the current master branch (35a819fa), when the Tag is 67: else if (tag==67) //0x43: Sample skew { int skew=0; // [1] curPos += ifread(&skew, 1, len,hdr); In this case, the address of the newly-defined integer skew \[1\] is overflowed instead of buf. This means a stack overflow can occur using much smaller values of len in this code path.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2025-54492?
CVE-2025-54492 is classified as a critical severity vulnerability due to the potential for arbitrary code execution.
How do I fix CVE-2025-54492?
To fix CVE-2025-54492, update The Biosig Project libbiosig to version 3.9.1 or higher, as this version addresses the vulnerability.
What systems are impacted by CVE-2025-54492?
CVE-2025-54492 affects The Biosig Project libbiosig version 3.9.0 and the Master Branch.
Can CVE-2025-54492 be exploited remotely?
Yes, an attacker can exploit CVE-2025-54492 remotely by delivering a specially crafted MFER file.
What are the potential consequences of exploiting CVE-2025-54492?
Exploitation of CVE-2025-54492 can lead to arbitrary code execution, potentially compromising the affected system.