calibre is an e-book manager. In versions 8.13.0 and prior, calibre does not validate filenames when handling binary assets in FB2 files, allowing an attacker to write arbitrary files on the filesystem when viewing or converting a malicious FictionBook file. This can be leveraged to achieve arbitrary code execution. This issue is fixed in version 8.14.0.

The remote Debian 11 host has packages installed that are affected by multiple vulnerabilities as referenced in the dla-4554 advisory.

    - -------------------------------------------------------------------------     Debian LTS Advisory DLA-4554-1                debian-lts@lists.debian.org     https://www.debian.org/lts/security/                          Abhijith PA     April 29, 2026                                https://wiki.debian.org/LTS
    - -------------------------------------------------------------------------

    Package        : calibre     Version        : 5.12.0+dfsg-1+deb11u4     CVE ID         : CVE-2025-64486 CVE-2026-25635 CVE-2026-25636 CVE-2026-26064                      CVE-2026-26065

    Multiple vulnerabilities have been discovered in calibre, an e-book     manager

    CVE-2025-64486

        calibre does not validate filenames when handling binary assets in         FB2 files, allowing an attacker to write arbitrary files on the         filesystem when viewing or converting a malicious FictionBook         file. This can be leveraged to achieve arbitrary code execution.

    CVE-2026-25635

        Calibre's CHM reader contains a path traversal vulnerability that         allows arbitrary file writes anywhere the user has write         permissions.

    CVE-2026-25636

        a path traversal vulnerability in Calibre's EPUB conversion allows         a malicious EPUB file to corrupt arbitrary existing files writable         by the Calibre process

    CVE-2026-26064

        a path traversal vulnerability that allows arbitrary file writes         anywhere the user has write permissions.

    CVE-2026-26065

        Path Traversal through PDB readers that allow arbitrary file         writes with arbitrary extension and arbitrary content anywhere the         user has write permissions. Files are written in 'wb' mode,         silently overwriting existing files. This can lead to potential         code execution and Denial of Service through file corruption.

    For Debian 11 bullseye, these problems have been fixed in version     5.12.0+dfsg-1+deb11u4.

    We recommend that you upgrade your calibre packages.

    For the detailed security status of calibre please refer to     its security tracker page at:
    https://security-tracker.debian.org/tracker/calibre

    Further information about Debian LTS security advisories, how to apply     these updates to your system and frequently asked questions can be     found at: https://wiki.debian.org/LTS

Tenable has extracted the preceding description block directly from the Debian security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 43 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2025-355be35bb1 advisory.

    Update to 8.14.0. Fixes rhbz#2413304

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - calibre is an e-book manager. In versions 8.13.0 and prior, calibre does not validate filenames when     handling binary assets in FB2 files, allowing an attacker to write arbitrary files on the filesystem when     viewing or converting a malicious FictionBook file. This can be leveraged to achieve arbitrary code     execution. This issue is fixed in version 8.14.0. (CVE-2025-64486)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Severity
311182	Debian dla-4554 : calibre - security update	Nessus	Debian Local Security Checks	critical
276593	Fedora 43 : calibre (2025-355be35bb1)	Nessus	Fedora Local Security Checks	critical
274556	Linux Distros Unpatched Vulnerability : CVE-2025-64486	Nessus	Misc.	critical

Detections

Analytics

CVE-2025-64486

critical

Tenable Plugins

critical

critical

critical