Cisco Talos Discloses Critical Vulnerabilities in Medical and Security Software Libraries Cisco Talos’ Vulnerability Discovery & Research team recently uncovered and disclosed multiple vulnerabilities in three widely used software libraries: Libbiosig, Grassroot DICOM, and Smallstep step-ca. While patches have been released for most flaws, the Grassroot DICOM vulnerabilities remain unpatched zero-days. ### Libbiosig: Stack-Based Buffer Overflows Researcher Mark Bereza identified six stack-based buffer overflow vulnerabilities (TALOS-2025-2296, CVE-2025-66043–CVE-2025-66048) in Libbiosig 3.9.1, an open-source library for biomedical signal processing. The flaws reside in the MFER parsing functionality, allowing attackers to execute arbitrary code by supplying a maliciously crafted MFER file. ### Grassroot DICOM: Zero-Day Information Leaks Emmanuel Tacheau discovered three out-of-bounds read vulnerabilities in Grassroot DICOM, a C++ library for medical imaging files. The flaws (TALOS-2025-2210, TALOS-2025-2211, TALOS-2025-2214) can expose sensitive data, including heap memory, when processing malicious files. Unlike the other vulnerabilities, these remain unpatched zero-days. ### Smallstep step-ca: Additional Flaws Researcher Stephen Kubik of Cisco’s Advanced Security Initiatives Group (ASIG) identified vulnerabilities in Smallstep step-ca, a certificate authority (CA) tool. Details on these flaws were not fully disclosed in the article, but patches have been issued. ### Impact & Response The vulnerabilities affect systems processing medical imaging, biomedical signals, and certificate management. While Libbiosig and Smallstep step-ca have released fixes, organizations using Grassroot DICOM should exercise caution until patches are available. Cisco Talos has provided detection rules via Snort to help identify exploitation attempts.