CVE-2025-6196
Last modified
CVE-2025-6196 is a medium-severity vulnerability rated 5.5/10 on the CVSS scale. A flaw was found in libgepub, a library used to read EPUB files. The software mishandles file size calculations when opening specially crafted EPUB files, leading to incorrect memory allocations. EPSS estimates a 0.19% chance of exploitation in the next 30 days.
Description
A flaw was found in libgepub, a library used to read EPUB files. The software mishandles file size calculations when opening specially crafted EPUB files, leading to incorrect memory allocations. This issue causes the application to crash. Known affected usage includes desktop services like Tumbler, which may process malicious files automatically when browsing directories. While no direct remote attack vectors are confirmed, any application using libgepub to parse user-supplied EPUB content could be vulnerable to a denial of service.
Metrics
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Weakness Enumeration
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Gnome | Libgepub | All versions |
References
- https://access.redhat.com/security/cve/CVE-2025-6196Mitigation, Third Party Advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=2373117Issue Tracking, Third Party Advisory
- https://gitlab.gnome.org/GNOME/libgepub/-/issues/18Exploit, Issue Tracking, Third Party Advisory
Timeline
- Published
- Last Modified
- Status
- Analyzed
Frequently Asked Questions
What is CVE-2025-6196?
How severe is CVE-2025-6196?
How do I fix CVE-2025-6196?
Are you affected by CVE-2025-6196?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST