Staging Environment: Content and features may be unstable or change without notice.
Search for vulnerabilities
Vulnerability details: VCID-b3vv-xdp2-7ub8
Vulnerability ID VCID-b3vv-xdp2-7ub8
Aliases CVE-2025-64486
Summary calibre is an e-book manager. In versions 8.13.0 and prior, calibre does not validate filenames when handling binary assets in FB2 files, allowing an attacker to write arbitrary files on the filesystem when viewing or converting a malicious FictionBook file. This can be leveraged to achieve arbitrary code execution. This issue is fixed in version 8.14.0.
Status Published
Exploitability 0.5
Weighted Severity 8.4
Risk 4.2
Affected and Fixed Packages Package Details
Weaknesses (1)
CWE-73 External Control of File Name or Path
System Score Found at
epss 0.00033 https://api.first.org/data/v1/epss?cve=CVE-2025-64486
epss 0.00033 https://api.first.org/data/v1/epss?cve=CVE-2025-64486
epss 0.00033 https://api.first.org/data/v1/epss?cve=CVE-2025-64486
epss 0.00033 https://api.first.org/data/v1/epss?cve=CVE-2025-64486
epss 0.00033 https://api.first.org/data/v1/epss?cve=CVE-2025-64486
epss 0.00033 https://api.first.org/data/v1/epss?cve=CVE-2025-64486
epss 0.00053 https://api.first.org/data/v1/epss?cve=CVE-2025-64486
epss 0.00053 https://api.first.org/data/v1/epss?cve=CVE-2025-64486
cvssv4 9.3 https://github.com/kovidgoyal/calibre/commit/6f94bce214bf7d43c829804db3741afa5e83c0c5
ssvc Track https://github.com/kovidgoyal/calibre/commit/6f94bce214bf7d43c829804db3741afa5e83c0c5
cvssv4 9.3 https://github.com/kovidgoyal/calibre/security/advisories/GHSA-hpwq-c98h-xp8g
ssvc Track https://github.com/kovidgoyal/calibre/security/advisories/GHSA-hpwq-c98h-xp8g
Reference id Reference type URL
https://api.first.org/data/v1/epss?cve=CVE-2025-64486
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-64486
6f94bce214bf7d43c829804db3741afa5e83c0c5 https://github.com/kovidgoyal/calibre/commit/6f94bce214bf7d43c829804db3741afa5e83c0c5
GHSA-hpwq-c98h-xp8g https://github.com/kovidgoyal/calibre/security/advisories/GHSA-hpwq-c98h-xp8g
No exploits are available.
Vector: CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H Found at https://github.com/kovidgoyal/calibre/commit/6f94bce214bf7d43c829804db3741afa5e83c0c5
Attack Vector (AV) Attack Complexity (AC) Attack Requirements (AT) Privileges Required (PR) User Interaction (UI) Vulnerable System Impact Confidentiality (VC) Vulnerable System Impact Integrity (VI) Vulnerable System Impact Availability (VA) Subsequent System Impact Confidentiality (SC) Subsequent System Impact Integrity (SI) Subsequent System Impact Availability (SA)

network

adjacent

local

physical

low

high

none

present

none

low

high

none

passive

active

high

low

none

high

low

none

high

low

none

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:N/A:N/T:T/P:M/B:A/M:M/D:T/2025-11-13T21:34:15Z/ Found at https://github.com/kovidgoyal/calibre/commit/6f94bce214bf7d43c829804db3741afa5e83c0c5
Vector: CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H Found at https://github.com/kovidgoyal/calibre/security/advisories/GHSA-hpwq-c98h-xp8g
Attack Vector (AV) Attack Complexity (AC) Attack Requirements (AT) Privileges Required (PR) User Interaction (UI) Vulnerable System Impact Confidentiality (VC) Vulnerable System Impact Integrity (VI) Vulnerable System Impact Availability (VA) Subsequent System Impact Confidentiality (SC) Subsequent System Impact Integrity (SI) Subsequent System Impact Availability (SA)

network

adjacent

local

physical

low

high

none

present

none

low

high

none

passive

active

high

low

none

high

low

none

high

low

none

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:N/A:N/T:T/P:M/B:A/M:M/D:T/2025-11-13T21:34:15Z/ Found at https://github.com/kovidgoyal/calibre/security/advisories/GHSA-hpwq-c98h-xp8g
Exploit Prediction Scoring System (EPSS)
Percentile 0.09566
EPSS Score 0.00033
Published At April 7, 2026, 12:55 p.m.
Date Actor Action Source VulnerableCode Version
2026-04-01T16:39:06.585991+00:00 Debian Oval Importer Import https://www.debian.org/security/oval/oval-definitions-bullseye.xml.bz2 38.0.0