CVE-2025-53853 is a Critical severity heap-based buffer overflow (CVSS 9.8) in The Biosig Project libbiosig 3.9.0 and the master branch at commit 35a819fa. A crafted ISHNE ECG annotations file can lead to code execution. The record names no fixed version, so check the Talos report.
What's affected
The record lists libbiosig 3.9.0 and the master branch at commit 35a819fa as affected. The flaw is in the parser for the ISHNE format, an electrocardiogram file type, and specifically in how it handles annotation data.
No fixed version is given. The reference is the Talos report TALOS-2025-2232, and you should read it together with the project repository to see whether a later commit or release contains a change.
Libbiosig is a library for reading biosignal files, so it can sit inside other tools. Software that converts or views ECG and other biosignal recordings may carry it without saying so.
How to check if you're exposed
See whether the library is on your systems, and in which form:
dpkg -l | grep -i biosig
find / -name "libbiosig*" 2>/dev/null
pip list 2>/dev/null | grep -i biosig
If you build from source, check the commit you built from against the one in the record. Then list the workflows that read ISHNE files, for example research pipelines, import tools and viewers, and mark those that accept files from outside the organisation. Those are the places the weakness can be reached.
What to do now
- Inventory every tool that includes libbiosig, including bundled copies inside research or clinical software.
- Read the Talos report and the project history for a fix, and upgrade or rebuild once you can confirm one.
- Do not open ISHNE files from untrusted sources with tools that use this library until a fix is confirmed.
- Process incoming recordings in a container or a sandbox with no network access and no sensitive data.
- Add the library to continuous monitoring so a later fix or new record reaches you quickly.
Why it matters
The weakness is CWE-122, a heap-based buffer overflow. A parser reads a length or a count from the file and uses it to copy data into a fixed size block on the heap. If the value is larger than the block, the copy writes past its end and damages nearby memory, which an attacker can sometimes steer into running code.
The cure is to treat every length in a file as untrusted. Check it against the buffer size before copying, and fail the parse if it does not fit. Memory safe languages remove the whole class, but a C library like this one depends on careful checks.
The record is not in the CISA Known Exploited Vulnerabilities catalogue. The record does not claim attacks, but the code execution impact and the lack of any privilege requirement make files from outside the team a real concern.
Quick check
Is there a fixed release of libbiosig?
The record does not name one. Check the Talos report and the project repository, and treat 3.9.0 as affected until you confirm a change.
Who is most at risk?
Anyone who opens biosignal files from other people, for example through a shared dataset, a vendor or an email, using software that includes this library.
Sources
Last reviewed: 18 October 2026.
