Loading story…
Several critical stack-based buffer overflow vulnerabilities have been identified in the MFER parsing functionality of The Biosig Project's libbiosig version 3.9.1. These vulnerabilities, tracked as CVE-2025-66044, CVE-2025-66045, CVE-2025-66046, CVE-2025-66047, and CVE-2025-66048, allow remote attackers to execute arbitrary code by supplying specially crafted MFER files. The vulnerabilities are present in the sopen_extended function, which is responsible for parsing various medical signal data formats, and can be triggered when specific MFER tags are processed. All vulnerabilities have been assigned a CVSS 3.1 base score of 9.8 (critical), and exploitation does not require authentication or user interaction.
libbiosig is widely used in scientific and medical software, including Octave, Matlab, and sigviewer, for processing biomedical signal data such as EKG and EEG. The vulnerabilities were disclosed by Cisco Talos, which confirmed that version 3.9.1 is affected. Attackers exploiting these flaws could compromise systems that process untrusted MFER files, potentially impacting healthcare and research environments that rely on this library. Organizations using libbiosig are strongly advised to review the affected versions and apply any available patches or mitigations immediately.
See affected versions and whether adversaries are exploiting it.
3 events from the most recent confirmed update back to the earliest known activity.
CVE entries including CVE-2025-66044, CVE-2025-66045, CVE-2025-66046, CVE-2025-66047, and CVE-2025-66048 were published, documenting critical remote code execution risks in libbiosig's MFER parser. Several entries identified specific trigger conditions such as crafted tags and advised users to update and avoid processing untrusted MFER files.
Cisco Talos disclosed multiple critical stack-based buffer overflow vulnerabilities in The Biosig Project's libbiosig MFER parsing functionality, affecting version 3.9.1. The disclosure said the bugs were caused by improper handling of MFER length fields and noted public proof-of-concept exploit availability for some issues.
The Biosig Project released a patch for multiple stack-based buffer overflow vulnerabilities in libbiosig 3.9.1 affecting MFER parsing. The flaws, later assigned CVE-2025-66043 through CVE-2025-66048, could allow remote arbitrary code execution via crafted MFER files.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
6 references tracked. Mallory keeps watching after this page renders.
cvefeed.io
Open sourcecvefeed.io
Open sourcecvefeed.io
Open sourcecvefeed.io
Open sourcecvefeed.io
Open sourcetalosintelligence.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Two high-severity vulnerabilities were disclosed in **Mbed TLS**, including a buffer overflow in FFDH public key export tracked as `CVE-2026-34875` and a memory-corruption issue tied to serialized SSL context or session structures tracked as `CVE-2026-34877`. The first flaw affects **Mbed TLS through 3.6.5** and **TF-PSA-Crypto 1.0.0**, while the second impacts **Mbed TLS 2.19.0 through 3.6.5** as well as **4.0.0**. Both issues were assigned a `CVSS v3.1` score vector of `AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H`, indicating remotely exploitable conditions with low attack complexity and high impact on confidentiality, integrity, and availability. `CVE-2026-34875` is classified under **CWE-120** and occurs during export of FFDH public keys, creating a buffer overflow condition. `CVE-2026-34877` is associated with **CWE-502** and **CWE-250** and can lead to arbitrary code execution if an attacker can alter serialized SSL context or session data before it is processed. Mbed TLS security advisories were published for both flaws, putting organizations that embed the library in network-facing products, cryptographic services, or TLS-enabled applications on notice to review affected versions and vendor guidance immediately.
Jun 29, 2026
Cisco Talos disclosed four heap-based buffer overflow vulnerabilities in the MediaArea **MediaInfoLib** library affecting version `26.01`. The flaws, tracked as `CVE-2026-25104`, `CVE-2026-25713`, `CVE-2026-28764`, and `CVE-2026-22554`, were discovered by Dimitrios Tatsis and mapped by Talos to `TALOS-2026-2367`, `TALOS-2026-2368`, `TALOS-2026-2371`, and `TALOS-2026-2374`. Talos said the vulnerabilities can be triggered when an attacker supplies a specially crafted media file, potentially leading to arbitrary code execution in affected environments. MediaArea has patched the issues under Cisco’s third-party vulnerability disclosure process, and Talos said updated **Snort** rule sets are available to help defenders detect exploitation attempts targeting the library.
Jun 29, 2026
CISA issued an advisory for **CVE-2026-3650**, a high-severity denial-of-service vulnerability in **Grassroots DICOM (GDCM) 3.2.2)**, a C++ library used to process DICOM medical images in healthcare environments. The flaw is a **memory leak** (`CWE-401`) triggered when the library parses malformed DICOM files containing non-standard VR types in file meta information, leading to excessive memory allocation, heap exhaustion, and potential service disruption from a single read operation. The issue carries a **CVSS v3.1 score of 7.5** with the vector `AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H`. Researchers **Volodymyr Bihunenko, Mykyta Mudryi, and Markiian Chaklosh of ARIMLABS** reported the vulnerability to CISA. The agency said the bug could be exploited remotely by sending a specially crafted file and warned that affected organizations in the **healthcare and public health sector worldwide** may be exposed if they rely on the library. CISA reported no known public exploitation at publication time, but said **no patch is currently available** and that the maintainer did not respond to mitigation requests; in the meantime, it recommended reducing exposure by keeping affected systems off the public internet, segmenting networks behind firewalls, and securing remote access with up-to-date VPNs.
Jun 29, 2026