File Handling Vulnerability in Calibre e-Book Manager by Kovid Goyal
CVE-2025-64486

9.3CRITICAL

Key Information:

Vendor

Kovidgoyal

Status
Calibre
Vendor
CVE Published:
7 November 2025

What is CVE-2025-64486?

Calibre, an e-book manager developed by Kovid Goyal, has a significant vulnerability where it fails to validate filenames when processing binary assets in FictionBook (FB2) files. This flaw allows an attacker to manipulate the system by writing arbitrary files to the filesystem during the viewing or conversion of a malicious FB2 file. If exploited, it can lead to arbitrary code execution on affected systems. This issue was promptly addressed and fixed in version 8.14.0, highlighting the importance of keeping software up-to-date to mitigate security risks.

Affected Version(s)

calibre < 8.14.0

References

https://github.com/kovidgoyal/calibre/security/advisories...
x_refsource_CONFIRM
https://github.com/kovidgoyal/calibre/commit/6f94bce214bf...
x_refsource_MISC

CVSS V4

Score:
9.3
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Local
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
Unknown

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.