A flaw was found in libgepub, a library used to read EPUB files. The software mishandles file size calculations when opening specially crafted EPUB files, leading to incorrect memory allocations. This issue causes the application to crash. Known affected usage includes desktop services like Tumbler, which may process malicious files automatically when browsing directories. While no direct remote attack vectors are confirmed, any application using libgepub to parse user-supplied EPUB content could be vulnerable to a denial of service.

The version of libgepub installed on the remote host is prior to 0.6.0-1. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2025-2910 advisory.

    A flaw was found in libgepub, a library used to read EPUB files. The software mishandles file size     calculations when opening specially crafted EPUB files, leading to incorrect memory allocations. This     issue causes the application to crash. Known affected usage includes desktop services like Tumbler, which     may process malicious files automatically when browsing directories. While no direct remote attack vectors     are confirmed, any application using libgepub to parse user-supplied EPUB content could be vulnerable to a     denial of service. (CVE-2025-6196)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 / openSUSE 15 host has packages installed that are affected by a vulnerability as referenced in the SUSE-SU-2025:02222-1 advisory.

    - CVE-2025-6196: Fixed an integer overflow in the EPUB archive handling code that can leads to massive     memory allocation and application crash. (bsc#1244704)

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 host has packages installed that are affected by a vulnerability as referenced in the SUSE- SU-2025:02213-1 advisory.

    - CVE-2025-6196: Fixed an integer overflow in the EPUB archive handling code that can leads to massive     memory allocation and application crash. (bsc#1244704)

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
241726	Amazon Linux 2 : libgepub (ALAS-2025-2910)	Nessus	Amazon Linux Local Security Checks	medium
241381	SUSE SLES15 / openSUSE 15 Security Update : libgepub (SUSE-SU-2025:02222-1)	Nessus	SuSE Local Security Checks	medium
241236	SUSE SLES15 Security Update : libgepub (SUSE-SU-2025:02213-1)	Nessus	SuSE Local Security Checks	medium

Detections

Analytics

CVE-2025-6196

medium

Tenable Plugins

medium

medium

medium