CVE-2025-6196

MEDIUM

libgepub - Denial of Service via Malicious EPUB File Size Calculation

Title source: llm

Description

A flaw was found in libgepub, a library used to read EPUB files. The software mishandles file size calculations when opening specially crafted EPUB files, leading to incorrect memory allocations. This issue causes the application to crash. Known affected usage includes desktop services like Tumbler, which may process malicious files automatically when browsing directories. While no direct remote attack vectors are confirmed, any application using libgepub to parse user-supplied EPUB content could be vulnerable to a denial of service.

References (3)

Core 3

Core References

Mitigation, Third Party Advisory vdb-entry x_refsource_redhat

https://access.redhat.com/security/cve/CVE-2025-6196

Issue Tracking, Third Party Advisory issue-tracking x_refsource_redhat

https://bugzilla.redhat.com/show_bug.cgi?id=2373117

Exploit, Issue Tracking, Third Party Advisory

https://gitlab.gnome.org/GNOME/libgepub/-/issues/18

Scores

CVSS v3 5.5

EPSS 0.0007

EPSS Percentile 21.6%

Attack Vector LOCAL

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

CISA SSVC

Vulnrichment

Exploitation none

Automatable no

Technical Impact partial

Details

CWE

CWE-190

Status published

Products (1)

gnome/libgepub

Published Jun 17, 2025

Tracked Since Feb 18, 2026