CVE-2025-66047

Technical Details

CVE-2025-66047 arises from insufficient bounds checking within the MFER parsing routines of libbiosig 3.9.1. Specifically, when processing MFER files, the application fails to properly validate the size of data being written to a stack-allocated buffer. This occurs when the 'Tag' value within the MFER file is equal to 131. An attacker can craft a malicious MFER file containing a 'Tag' value of 131 and an oversized data payload. When libbiosig attempts to parse this file, the oversized data will overflow the stack buffer, overwriting adjacent memory regions. This memory corruption can be leveraged to overwrite return addresses on the stack, allowing the attacker to redirect program execution to arbitrary code of their choosing. The vulnerability is triggered during the processing of the MFER file, making it a file format vulnerability. Successful exploitation requires the victim application to process the malicious MFER file.

The root cause is the lack of proper input validation and sanitization before copying data into the stack buffer. The application should implement robust size checks to ensure that the data being written does not exceed the buffer's capacity. Additionally, using safer memory management techniques, such as heap allocation with dynamic resizing, could mitigate the risk of stack-based buffer overflows.