CVE-2025-66043

Technical Details

CVE-2025-66043 arises from insufficient bounds checking during the parsing of MFER (Multi-Format EEG/MEG Recording) files within libbiosig 3.9.1. Specifically, when the 'Tag' value within the MFER file is equal to 3, the parsing logic fails to properly validate the size of data being copied into a stack-allocated buffer. This lack of validation allows an attacker to overwrite adjacent memory regions on the stack, leading to a buffer overflow. By carefully crafting the malicious MFER file, an attacker can control the overwritten memory and inject arbitrary code, ultimately achieving remote code execution. The vulnerability is triggered when the vulnerable parsing function is called with a malicious MFER file as input. The root cause lies in the unchecked size of the data being copied, combined with the use of stack-allocated buffers. Exploitation requires the victim application to process the malicious MFER file.

The vulnerability is located in the MFER parsing routines within the libbiosig library. A specially crafted MFER file with a 'Tag' value of 3 can trigger the overflow. The size of the data being copied is not validated against the size of the stack buffer, leading to the overflow when the data exceeds the buffer's capacity. Successful exploitation allows an attacker to overwrite the return address on the stack, redirecting execution flow to attacker-controlled code.