Stack Buffer Overflow Vulnerability in eBook-speaker by Book Readers

CVE-2026-123199

What is CVE-2026-123199?

The eBook-speaker software versions 6.1.0 through 6.2.0 are susceptible to a stack buffer overflow in the get_attributes() function within src/common.c. This vulnerability arises from an unbounded strcpy operation on an element's name attribute, enabling an attacker to craft images or text that exceed the expected length. If a crafted EPUB or DAISY book with a name attribute of 511 or more characters is opened, it can lead to stack corruption, resulting in a crash of the application.

References