A flaw was found in libgepub, a library used to read EPUB files. The software mishandles file size calculations when opening specially crafted EPUB files, leading to incorrect memory allocations. This issue causes the application to crash. Known affected usage includes desktop services like Tumbler, which may process malicious files automatically when browsing directories. While no direct remote attack vectors are confirmed, any application using libgepub to parse user-supplied EPUB content could be vulnerable to a denial of service.
CVE-2025-6196
CVSS base score
5.5 (v3.1)
Severity
MEDIUM
Attack vector
Local
Weakness
CWE-190
Last modified
November 5, 2026
CVSS vector
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Affected products
gnome libgepub
References
- access.redhat.com Mitigation, Third Party Advisory
- bugzilla.redhat.com Issue Tracking, Third Party Advisory
- gitlab.gnome.org Exploit, Issue Tracking, Third Party Advisory