CVE-2025-64736

HighCVSS 7.1/10Last modified Jun 17, 2026

Description

An out-of-bounds read vulnerability exists in the ABF parsing functionality of The Biosig Project libbiosig 3.9.2 and Master Branch (5462afb0). A specially crafted .abf file can lead to an information leak. An attacker can provide a malicious file to trigger this vulnerability.

Metrics

CVSS 3.1 7.1/10CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:H

Weakness enumeration

CWE-125

Affected software

Vendor	Product	Versions
The Biosig Project	libbiosig	3.9.2; Master Branch (5462afb0)

References

https://talosintelligence.com/vulnerability_reports/TALOS-2025-2323Exploit, Third Party Advisory
https://www.talosintelligence.com/vulnerability_reports/TALOS-2025-2323Exploit, Third Party Advisory

Timeline

Published: Mar 3, 2026
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2025

CVE-2025-647385.5External control of file name or path in Zoom Workplace for macOS before version 6.5.10 may allow an authenticated user to conduct a disclos CVE-2025-647397.5External control of file name or path in certain Zoom Clients may allow an unauthenticated user to conduct a disclosure of information via n CVE-2025-64749.8A vulnerability has been found in code-projects Inventory Management System 1.0 and classified as critical. This vulnerability affects unkno CVE-2025-647407.8Improper verification of cryptographic signature in the installer for Zoom Workplace VDI Client for Windows may allow an authenticated user CVE-2025-647419.8Improper authorization handling in Zoom Workplace for Android before version 6.5.10 may allow an unauthenticated user to conduct an escalati CVE-2025-647443.5OpenObserve is a cloud-native observability platform. In versions up to and including 0.16.1, when creating or renaming an organization with CVE-2025-647456.1Astro is a web framework. Starting in version 5.2.0 and prior to version 5.15.6, a Reflected Cross-Site Scripting (XSS) vulnerability exists CVE-2025-647465.4Directus is a real-time API and App dashboard for managing SQL database content. Prior to version 11.13.0, Directus does not properly clean CVE-2025-647475.5Directus is a real-time API and App dashboard for managing SQL database content. A stored cross-site scripting (XSS) vulnerability exists in CVE-2025-647486.5Directus is a real-time API and App dashboard for managing SQL database content. A vulnerability in versions prior to 11.13.0 allows authent CVE-2025-647494.3Directus is a real-time API and App dashboard for managing SQL database content. An observable difference in error messaging was found in th CVE-2025-64754.8A vulnerability was found in SourceCodester Student Result Management System 1.0 and classified as problematic. This issue affects some unkn