CVE-2025-54490

{"id": "CVE-2025-54490", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Primary", "source": "talos-cna@cisco.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 9.8, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 3.9}]}, "published": "2025-08-25T14:15:35.420", "references": [{"url": "https://talosintelligence.com/vulnerability_reports/TALOS-2025-2234", "tags": ["Exploit", "Third Party Advisory"], "source": "talos-cna@cisco.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "talos-cna@cisco.com", "description": [{"lang": "en", "value": "CWE-121"}]}], "descriptions": [{"lang": "en", "value": "A stack-based buffer overflow vulnerability exists in the MFER parsing functionality of The Biosig Project libbiosig 3.9.0 and Master Branch (35a819fa). A specially crafted MFER file can lead to arbitrary code execution. An attacker can provide a malicious file to trigger this vulnerability.This vulnerability manifests on line 9090 of biosig.c on the current master branch (35a819fa), when the Tag is 64:\r\n\r\n else if (tag==64) //0x40\r\n {\r\n // preamble\r\n char tmp[256]; // [1]\r\n curPos += ifread(tmp,1,len,hdr);\r\n\r\nIn this case, the overflowed buffer is the newly-declared `tmp` \\[1\\] instead of `buf`. While `tmp` is larger than `buf`, having a size of 256 bytes, a stack overflow can still occur in cases where `len` is encoded using multiple octets and is greater than 256."}, {"lang": "es", "value": "Existe una vulnerabilidad de desbordamiento de b\u00fafer en la pila en la funcionalidad de an\u00e1lisis MFER de The Biosig Project libbiosig 3.9.0 y Master Branch (35a819fa). Un archivo MFER especialmente manipulado puede provocar la ejecuci\u00f3n de c\u00f3digo arbitrario. Un atacante puede proporcionar un archivo malicioso para activar esta vulnerabilidad. Esta vulnerabilidad se manifiesta en la l\u00ednea 9090 de biosig.c en la rama maestra actual (35a819fa), cuando la etiqueta es 64: else if (tag==64) //0x40 { // pre\u00e1mbulo char tmp[256]; // [1] curPos += ifread(tmp,1,len,hdr); En este caso, el b\u00fafer desbordado es el reci\u00e9n declarado `tmp` \\[1\\] en lugar de `buf`. Si bien `tmp` es m\u00e1s grande que `buf`, con un tama\u00f1o de 256 bytes, a\u00fan puede ocurrir un desbordamiento de pila en los casos en que `len` se codifica utilizando m\u00faltiples octetos y es mayor a 256."}], "lastModified": "2025-09-02T16:42:32.483", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:libbiosig_project:libbiosig:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "4893D615-FD95-4393-A5B0-E1BE19F180A6", "versionEndExcluding": "3.9.1"}], "operator": "OR"}]}], "sourceIdentifier": "talos-cna@cisco.com"}