CVE-2026-123199 · Other
NO FIX YET · SEE WHAT TO DO
eBook-speaker 6.1.0 through 6.2.0 copies an element's name attribute into a fixed stack buffer with an unbounded strcpy in get_attributes(). A crafted EPUB or DAISY book with a name of 511 or more characters corrupts the stack and crashes the reader when opened.
first public Nov 5, 2026 · 1 source
Check it with your coding agent
It checks your repository and tells you if you’re affected, with the fix.
Anyone who opens a crafted EPUB or DAISY book in an affected eBook-speaker version (6.1.0 through 6.2.0) is exposed. The sources describe a crash on open; they do not say whether code execution is possible. Systems that never open untrusted books with this reader can skip it.
Not affected if untrusted-books-not-opened, version-outside-6.1.0-6.2.0
Who cares daisy, ebook-speaker, epub, linux
6.1.0 through 6.2.0eBook-speaker 6.1.0 through 6.2.0 contains a stack buffer overflow vulnerability in get_attributes() in src/common.c caused by an unbounded strcpy of an element's name attribute. Attackers can craft an EPUB or DAISY book with a name attribute of 511 or more characters to corrupt the stack and crash the reader when opened.
This page as .md · .json · CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.