CVE-2025-46411 is a high severity stack-based buffer overflow (CVSS 8.1) in the MFER parsing code of the Biosig Project's libbiosig, version 3.9.0 and the master branch at the time. A crafted MFER file can lead to code execution. The record lists no fixed version, so check the Talos report.
What's affected
The NVD record, published from a Cisco Talos report, names libbiosig 3.9.0 and the master branch at commit 35a819fa. libbiosig is a library for reading and writing biosignal files such as ECG and EEG recordings, and it is used by tools that open many file formats.
The record does not name a fixed version. The issue sits in the code that parses MFER files, so it matters most to applications that open files from outside your organisation.
How to check if you're exposed
Find out whether libbiosig is in your software and how it is used.
- Python: run
pip show biosigorpip list | grep -i biosigin each environment. - System packages: use
dpkg -l | grep -i biosigon Debian based systems orrpm -qa | grep -i biosigon Red Hat based systems. - Source builds: search your dependency files and SBOM for libbiosig, and check which commit you build from.
- Applications such as signal viewers and converters may bundle the library, so check their documentation.
Then note whether any of these tools opens MFER files from emails, downloads or shared drives.
What to do now
- Find every system and application that includes libbiosig 3.9.0 or the affected master code.
- Read the Talos report and the project's repository for a fix, and upgrade to a release that includes it.
- Until then, avoid opening MFER files from untrusted sources in tools that use the library.
- Run file conversion and viewing tools with low privileges and in a container or a sandbox, so that a crash cannot reach sensitive data.
- Block MFER attachments at your mail gateway where you have no use for them.
- Rebuild applications that bundle the library once a fixed version is available.
Why it matters
The record lists CWE-121 (Stack-based Buffer Overflow). A stack-based buffer overflow occurs when a program copies more data into a fixed size area on the call stack than it can hold. The extra data overwrites nearby values, including control data, which can let a crafted file take over execution.
The attack complexity in the vector is high, and a victim must open a file, which keeps the score at 8.1 instead of 9.8 or higher. Even so, file parsers are classic targets, and research and medical tooling often runs with broad access to patient or lab data. The record does not mark this CVE as exploited in the wild, and it is not on the CISA Known Exploited Vulnerabilities list.
Quick check
Does an attacker need network access to my machine?
The vector says the attack is network based, but the record describes a crafted file that someone has to open or process.
Is there a fixed version?
The record names none. Check the Talos report and the project repository.
Sources
Last reviewed: 18 October 2026.
