PT-2025-25663 · Libgepub+2 · Libgepub+2

Mhzcyber + 1 · Published 2025-06-17 · Updated 2025-09-30 · CVE-2025-6196

Positive Technologies (AI Summary)

CVSS v3.1

5.5

Medium

Base vector

AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions libgepub (affected versions not specified)

Description A flaw in libgepub causes the software to mishandle file size calculations when opening specially crafted EPUB files, leading to incorrect memory allocations. This results in the application crashing. The issue may affect applications that use libgepub to parse user-supplied EPUB content, potentially leading to a denial of service. Known affected usage includes desktop services like Tumbler, which may process malicious files automatically when browsing directories.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

DoS

Integer Overflow

Weakness Enumeration

CWE-190

Related Identifiers

BDU:2025-12601

CVE-2025-6196

SUSE-SU-2025:02213-1

SUSE-SU-2025:02222-1

Affected Products

Debian

Red Os

Libgepub

References · 23

• 🔥 https://gitlab.gnome.org/GNOME/libgepub/-/issues/18 · Exploit
• https://osv.dev/vulnerability/SUSE-SU-2025:02222-1 · Vendor Advisory
• https://bdu.fstec.ru/vul/2025-12601 · Security Note
• https://osv.dev/vulnerability/SUSE-SU-2025:02213-1 · Vendor Advisory
• https://ubuntu.com/security/CVE-2025-6196 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2025-6196 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2025-6196 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2025-6196 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2025-6196 · Security Note
• https://osv.dev/vulnerability/DEBIAN-CVE-2025-6196 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2025-6196 · Vendor Advisory
• https://twitter.com/CVEnew/status/1934984673446506958 · Twitter Post
• https://t.me/cveNotify/131792 · Telegram Post
• https://twitter.com/Cezar_H_Linux/status/1941257758495604867 · Twitter Post
• https://redos.red-soft.ru/support/secure/uyazvimosti/support/secure/uyazvimosti/uyazvimost-libgepub-cve-2025-6196 · Note