CVE-2025-66046

CriticalCVSS 9.8/10Last modified Oct 7, 2026

Description

Several stack-based buffer overflow vulnerabilities exists in the MFER parsing functionality of The Biosig Project libbiosig 3.9.1. A specially crafted MFER file can lead to arbitrary code execution. An attacker can provide a malicious file to trigger these vulnerabilities.When Tag is 67

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-121CWE-787

Affected software

VendorProductVersions
The Biosig Projectlibbiosig3.9.1

References

Timeline

Published
Dec 11, 2025
Last modified
Oct 7, 2026
NVD status
Analyzed

Related CVEs from 2025

CVE-2025-660479.8Several stack-based buffer overflow vulnerabilities exists in the MFER parsing functionality of The Biosig Project libbiosig 3.9.1. A speciaCVE-2025-660489.8Several stack-based buffer overflow vulnerabilities exists in the MFER parsing functionality of The Biosig Project libbiosig 3.9.1. A speciaCVE-2025-660497.5Vivotek IP7137 camera with firmware version 0200a is vulnerable to an information disclosure issue where live camera footage can be accessedCVE-2025-66058.8A vulnerability classified as critical was found in SourceCodester Best Salon Management System 1.0. This vulnerability affects unknown codeCVE-2025-660509.8Vivotek IP7137 camera with firmware version 0200a by default dos not require to provide any password when logging in as an administrator. WhCVE-2025-660516.5Vivotek IP7137 camera with firmware version 0200a is vulnerable to path traversal. It is possible for an authenticated attacker to access reCVE-2025-660527.2Vivotek IP7137 camera with firmware version 0200a is vulnerable to command injection. Parameter "system_ntpIt" used by "/cgi-bin/admin/setpaCVE-2025-660536.5Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Kriesi Enfold enfold allows Stored XSSCVE-2025-660547.5Missing Authorization vulnerability in ThimPress LearnPress learnpress allows Exploiting Incorrectly Configured Access Control Security LeveCVE-2025-660557.2Deserialization of Untrusted Data vulnerability in Icegram Email Subscribers & Newsletters email-subscribers allows Object Injection.This isCVE-2025-660564.3Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in Uncanny Owl Uncanny Automator uncanny-automator CVE-2025-660576.5Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in boldthemes Bold Page Builder bold-page