CVE-2025-66045

Technical Details

CVE-2025-66045 describes a stack-based buffer overflow vulnerability present in the MFER (Medical Format for Electroencephalography Data) parsing component of libbiosig 3.9.1. The vulnerability occurs when the library processes a specially crafted MFER file containing an overly large or malformed data structure. Specifically, when the 'Tag' value within the MFER file is equal to 65, the parsing logic fails to properly validate the size of the data being copied into a fixed-size buffer on the stack. This lack of validation allows an attacker to overwrite adjacent memory regions on the stack, including return addresses and other critical data. By carefully controlling the overflowed data, an attacker can redirect program execution to arbitrary code, effectively gaining control of the affected system. The root cause is the insufficient bounds checking during the data processing within the MFER parsing routine. The overflow occurs due to the unchecked copying of data into a stack allocated buffer. The attacker can control the size and content of the data being copied, thus leading to arbitrary code execution.

The vulnerability is triggered by providing a malicious MFER file to an application that uses libbiosig to parse MFER data. This could occur through various attack vectors, such as a user opening a malicious file, a server processing uploaded files, or a network service receiving MFER data.