The Biosig Project Libbiosig Heap-Based Buffer Overflow Vulnerability in MFER Parsing

A heap-based buffer overflow vulnerability has been identified in The Biosig Project's libbiosig version 3.9.0 and the Master Branch (35a819fa). This vulnerability arises in the MFER (Medical waveform Format Encoding Rules) parsing functionality, where a specially crafted MFER file can lead to arbitrary code execution. The issue is triggered when a malicious file is processed by the library.

Impact

Exploitation of this vulnerability causes a heap-based buffer overflow, which can lead to arbitrary code execution.

Reproduction

The vulnerability can be reproduced by using libbiosig to parse a crafted MFER file that exploits the buffer overflow condition. This can be done by using the 'sopen_extended' function with a file that contains the appropriate magic bytes and channel data to trigger the overflow.

Remediation

Users are advised to update to the patched version of libbiosig released on August 24, 2025.