CVE catalog

CVE-2025-54494

biosig affected and fixed versions

A stack-based buffer overflow vulnerability exists in the MFER parsing functionality of The Biosig Project libbiosig 3.9.0 and Master Branch (35a819fa). A specially crafted MFER file can lead to arbitrary code execution. An attacker can provide a malicious file to trigger this vulnerability.This vulnerability manifests on line 9205 of biosig.c on the current master branch (35a819fa), when the Tag is 133: else if (tag==133) //0x85 { curPos += ifread(buf,1,len,hdr);

Severity: Medium
Published: Aug 25, 2025, 2:15:36 PM UTC
Source: [NVD] · [CVE record]
EPSS: 0.68% · Oct 27, 2026

Projects and upstream resources

[biosig][Source-reported homepage]

Reported versions and fixes

Each observation applies to its named package, distribution, and release. Distribution backports can fix a vulnerability while retaining an older upstream version number.

Version impact has not been established. The original provider fields are retained below.

Provider details and historical evidence

Original provider fields

{
  "package_releases": [
    {
      "name": "biosig",
      "status": "fixed",
      "release": "sid",
      "version": "3.9.5-1"
    },
    {
      "name": "biosig",
      "status": "fixed",
      "release": "forky",
      "version": "3.9.5-1"
    },
    {
      "name": "biosig",
      "status": "vulnerable",
      "release": "trixie",
      "version": "3.9.0-1"
    },
    {
      "name": "biosig",
      "status": "vulnerable",
      "release": "bookworm",
      "version": "2.5.0-1"
    }
  ],
  "fixed_versions": [
    {
      "bug": 1112133,
      "name": "biosig",
      "type": "source",
      "origin": null,
      "release": "sid",
      "urgency": "not yet assigned",
      "fixed_version": "3.9.5-1"
    },
    {
      "bug": 1112133,
      "name": "biosig",
      "type": "source",
      "origin": null,
      "release": "forky",
      "urgency": "not yet assigned",
      "fixed_version": "3.9.5-1"
    },
    {
      "bug": 1112133,
      "name": "biosig",
      "type": "source",
      "origin": null,
      "release": "trixie",
      "urgency": "not yet assigned",
      "fixed_version": ""
    },
    {
      "bug": 1112133,
      "name": "biosig",
      "type": "source",
      "origin": null,
      "release": "bookworm",
      "urgency": "not yet assigned",
      "fixed_version": ""
    }
  ],
  "distribution_packages": []
}

[Debian bug #1112133]

Publisher notes

[trixie] biosig: Minor issue [bookworm] biosig: Minor issue

OpenFactory catalog packages

Matching against OpenFactory catalog package versions is in progress.

[Debian 12 (Bookworm)]

[biosig-tools]Unknown
Source package: [biosig]
Details (2)
- 2.5.0-1+b1 · amd64 · bookworm
  Affected
  dsa · biosig · debian · bookworm; dsa · biosig · debian · 12
- 2.5.0-1+b1 · arm64 · bookworm
  Affected
  dsa · biosig · debian · bookworm; dsa · biosig · debian · 12
[libbiosig3]Unknown
Source package: [biosig]
Details (2)
- 2.5.0-1+b1 · amd64 · bookworm
  Affected
  dsa · biosig · debian · bookworm; dsa · biosig · debian · 12
- 2.5.0-1+b1 · arm64 · bookworm
  Affected
  dsa · biosig · debian · bookworm; dsa · biosig · debian · 12
[libbiosig-dev]Unknown
Source package: [biosig]
Details (2)
- 2.5.0-1+b1 · amd64 · bookworm
  Affected
  dsa · biosig · debian · bookworm; dsa · biosig · debian · 12
- 2.5.0-1+b1 · arm64 · bookworm
  Affected
  dsa · biosig · debian · bookworm; dsa · biosig · debian · 12
[octave-biosig]Unknown
Source package: [biosig]
Details (2)
- 2.5.0-1+b1 · amd64 · bookworm
  Affected
  dsa · biosig · debian · bookworm; dsa · biosig · debian · 12
- 2.5.0-1+b1 · arm64 · bookworm
  Affected
  dsa · biosig · debian · bookworm; dsa · biosig · debian · 12
[python3-biosig]Unknown
Source package: [biosig]
Details (2)
- 2.5.0-1+b1 · amd64 · bookworm
  Affected
  dsa · biosig · debian · bookworm; dsa · biosig · debian · 12
- 2.5.0-1+b1 · arm64 · bookworm
  Affected
  dsa · biosig · debian · bookworm; dsa · biosig · debian · 12

[Debian 13 (Trixie)]

[biosig-tools]Unknown
Source package: [biosig]
Details (2)
- 3.9.0-1 · amd64 · trixie
  Affected
  dsa · biosig · debian · 13
- 3.9.0-1 · arm64 · trixie
  Affected
  dsa · biosig · debian · 13
[libbiosig3]Unknown
Source package: [biosig]
Details (2)
- 3.9.0-1 · amd64 · trixie
  Affected
  dsa · biosig · debian · 13
- 3.9.0-1 · arm64 · trixie
  Affected
  dsa · biosig · debian · 13
[libbiosig-dev]Unknown
Source package: [biosig]
Details (2)
- 3.9.0-1 · amd64 · trixie
  Affected
  dsa · biosig · debian · 13
- 3.9.0-1 · arm64 · trixie
  Affected
  dsa · biosig · debian · 13
[octave-biosig]Unknown
Source package: [biosig]
Details (2)
- 3.9.0-1 · amd64 · trixie
  Affected
  dsa · biosig · debian · 13
- 3.9.0-1 · arm64 · trixie
  Affected
  dsa · biosig · debian · 13
[python3-biosig]Unknown
Source package: [biosig]
Details (2)
- 3.9.0-1 · amd64 · trixie
  Affected
  dsa · biosig · debian · 13
- 3.9.0-1 · arm64 · trixie
  Affected
  dsa · biosig · debian · 13

Observed: Oct 24, 2026, 7:23:50 PM UTC

References

[Debian Security Tracker] · [FIRST EPSS] · [OSV Package Vulnerability Database]