CVE-2025-52461: High Out-of-Bounds Read in libbiosig

CVE-2025-52461 is a high severity out of bounds read (CVSS 8.2) in the NEX file parser of The Biosig Project libbiosig 3.9.0 and the master branch at commit 35a819fa. A crafted .nex file can leak memory contents. The record names no fixed version, so check the Talos report and the project releases.

What's affected

The CVE record names The Biosig Project libbiosig 3.9.0 and the master branch at commit 35a819fa. The flaw is in the code that parses NEX files, a format used for neurophysiology data. Cisco Talos reported it as TALOS-2025-2238. The weakness is CWE-125 (out of bounds read).

The CVSS vector is CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H. It needs network delivery of a file, no privileges and no user interaction in the scoring, with a low confidentiality impact, no integrity impact and a high availability impact. In plain words, a bad file can disclose some memory and can crash the program that reads it. The record says an attacker can provide a malicious file to trigger it. The CISA Known Exploited Vulnerabilities flag is false for this CVE, and the record does not say it is exploited in the wild.

No fixed version appears in the record. The Talos page could not be retrieved while this post was written, so check it and the libbiosig releases for patch status.

How to check if you're exposed

libbiosig is a C library, so you may have it as a system package, as a build dependency, or inside a Python or Octave tool that wraps it. Start with the package manager:

dpkg -l | grep -i biosig
rpm -qa | grep -i biosig
pip list 2>/dev/null | grep -i biosig

If your software is built from source, look for a vendored copy of the library in the source tree and note the commit it was taken from. The record names version 3.9.0 and commit 35a819fa, so those are the confirmed affected states.

Then check where files come from. The risk is a program using libbiosig to open NEX files that arrive from outside, such as uploads, email attachments or shared research drives. A closed pipeline that only reads your own recordings carries much less risk. A dependency inventory shows which of your tools pull the library in, and the free scan at gold.safeguard.sh/scan can match a manifest against known issues.

What to do now

1. Find every application, container image and script that installs or bundles libbiosig.
2. Check the Talos report TALOS-2025-2238 and the libbiosig release notes for a fixed version, and update when one exists.
3. Until then, stop opening NEX files from untrusted sources with tools that use the library.
4. Where files are processed by a service, run the converter in a sandbox or container with limited memory and no secrets in its environment.
5. Add a crash alert to any batch job that converts these files, since the high availability score means a bad file can stop the process.
6. Record the library and its commit in your software inventory so a patch can be tracked.

Why it matters

An out of bounds read means the code reads past the end of a buffer. The program trusts a length or offset taken from the file instead of checking it against the size of its own memory. The result is a crash or a leak of whatever data sits next to the buffer.

File parsers are a steady source of this class of bug, because they turn untrusted bytes into structure, and each supported format has its own parser. A library with many formats has many places to get it wrong. Fuzzing finds these well, which is how reports like this one tend to surface.

For most teams the real risk is indirect. The library sits under a research tool, and nobody remembers it is there. Knowing where it runs and whether files from outside reach it is the part you control today.

Quick check

Sources

• Safeguard Gold record: https://gold.safeguard.sh/vulnerability/CVE-2025-52461
• Cisco Talos report TALOS-2025-2238, listed in the CVE record. The page was blocked when fetched, so details here come from the record.

Last reviewed: 18 October 2026.