CVE-2025-53853

A heap-based buffer overflow vulnerability exists in the ISHNE parsing functionality of The Biosig Project libbiosig 3.9.0 and Master Branch (35a819fa). A specially crafted ISHNE ECG annotations file can lead to arbitrary code execution. An attacker can provide a malicious file to trigger this vulnerability.

CVSS v3 9.8 CRITICAL

9.8^/10

CVSS v3 : CRITICAL

Vector :

Exploitability : 3.9 / Impact : 5.9

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://talosintelligence.com/vulnerability_reports/TALOS-2025-2232	Exploit Third Party Advisory
https://www.talosintelligence.com/vulnerability_reports/TALOS-2025-2232

Configurations

Configuration 1 (hide)

cpe:2.3:a:libbiosig_project:libbiosig:3.9.0:*:*:*:*:*:*:*

History

03 Nov 2025, 19:16

Type	Values Removed	Values Added
References		() https://www.talosintelligence.com/vulnerability_reports/TALOS-2025-2232 -

27 Aug 2025, 18:12

Type	Values Removed	Values Added
References	~~() https://talosintelligence.com/vulnerability_reports/TALOS-2025-2232 -~~	() https://talosintelligence.com/vulnerability_reports/TALOS-2025-2232 - Exploit, Third Party Advisory
First Time		Libbiosig Project Libbiosig Project libbiosig
CPE		cpe:2.3:a:libbiosig_project:libbiosig:3.9.0:::::::*
Summary		(es) Existe una vulnerabilidad de desbordamiento de búfer en el montón en la funcionalidad de análisis ISHNE de The Biosig Project libbiosig 3.9.0 y Master Branch (35a819fa). Un archivo de anotaciones de ECG de ISHNE especialmente manipulado puede provocar la ejecución de código arbitrario. Un atacante puede proporcionar un archivo malicioso para activar esta vulnerabilidad.

25 Aug 2025, 14:15

Type	Values Removed	Values Added
New CVE

Information

Published : 2025-08-25 14:15

Updated : 2025-11-03 19:16

NVD link : CVE-2025-53853

Mitre link : CVE-2025-53853

CVE.ORG link : CVE-2025-53853

JSON object : View

Products Affected

libbiosig_project

libbiosig

CWE

CWE-122

Heap-based Buffer Overflow

{"id": "CVE-2025-53853", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Secondary", "source": "talos-cna@cisco.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 9.8, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 3.9}, {"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 9.8, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 3.9}]}, "published": "2025-08-25T14:15:32.813", "references": [{"url": "https://talosintelligence.com/vulnerability_reports/TALOS-2025-2232", "tags": ["Exploit", "Third Party Advisory"], "source": "talos-cna@cisco.com"}, {"url": "https://www.talosintelligence.com/vulnerability_reports/TALOS-2025-2232", "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Secondary", "source": "talos-cna@cisco.com", "description": [{"lang": "en", "value": "CWE-122"}]}], "descriptions": [{"lang": "en", "value": "A heap-based buffer overflow vulnerability exists in the ISHNE parsing functionality of The Biosig Project libbiosig 3.9.0 and Master Branch (35a819fa). A specially crafted ISHNE ECG annotations file can lead to arbitrary code execution. An attacker can provide a malicious file to trigger this vulnerability."}, {"lang": "es", "value": "Existe una vulnerabilidad de desbordamiento de b\u00fafer en el mont\u00f3n en la funcionalidad de an\u00e1lisis ISHNE de The Biosig Project libbiosig 3.9.0 y Master Branch (35a819fa). Un archivo de anotaciones de ECG de ISHNE especialmente manipulado puede provocar la ejecuci\u00f3n de c\u00f3digo arbitrario. Un atacante puede proporcionar un archivo malicioso para activar esta vulnerabilidad."}], "lastModified": "2025-11-03T19:16:09.067", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:libbiosig_project:libbiosig:3.9.0:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "F4968E85-9135-4E89-9880-47FB8CE7AB34"}], "operator": "OR"}]}], "sourceIdentifier": "talos-cna@cisco.com"}