Vulnerability record/PUBLISHED/Published Jun 17, 2025 14:29:42 UTC
CVE-2025-6196
A flaw was found in libgepub, a library used to read EPUB files. The software mishandles file size calculations when opening specially crafted EPUB files, leading to incorrect memory allocations. This issue causes the application to crash. Known affected usage includes desktop services like Tumbler, which may process malicious files automatically when browsing directories. While no direct remote attack vectors are confirmed, any application using libgepub to parse user-supplied EPUB content could be vulnerable to a denial of service.
Base score5.5/ 10
SeverityMediumCVSS 3.1
Exploitability / impact
CVSS metric breakdown
Base severityMedium
Attack vectorLocalAV
Attack complexityLowAC
Privileges requiredNonePR
User interactionRequiredUI
ScopeUnchangedS
Confidentiality impactNoneC
Integrity impactNoneI
Availability impactHighA
CVSS vector string
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:HCVSS communicates standardized severity and impact characteristics. It does not establish whether a system is exploitable in your specific environment.
Record context
CVE Numbering Authorityredhat
Last updatedNov 5, 2026 16:32:44 UTC
PublishedJun 17, 2025 14:29:42 UTC
ReservedJun 17, 2025 06:50:22 UTC
Credits
- Red Hat would like to thank Mohammad Hussam Alzeyyat - mhzcyber for reporting this issue.