CVE-2026-123199: eBook-speaker through 6.2.0 Stack-based Buffer Overflow via element name attribute

Published Nov 5, 2026

Updated

eBook-speaker 6.1.0 through 6.2.0 contains a stack buffer overflow vulnerability in getattributes() in src/common.c caused by an unbounded strcpy of an element's name attribute. Attackers can craft an EPUB or DAISY book with a name attribute of 511 or more characters to corrupt the stack and crash the reader when opened.

Event History

Nov 5, 2026

CVE Published

via MITRE·06:16 PM

Data Sourced

via MITRE·06:16 PM

DescriptionSeverityWeakness

Data Sourced

via NVD·07:17 PM

DescriptionSeverityWeakness

Frequently Asked Questions

Who is exposed to this vulnerability?

Users of eBook-speaker versions 6.1.0 through 6.2.0 are exposed when they open a malicious EPUB or DAISY book. Exploitation requires local interaction because the user must open the crafted book.

What must an attacker provide to trigger the issue?

The attacker must craft an EPUB or DAISY book containing an element name attribute that is 511 or more characters long. Processing that attribute reaches get_attributes(), where an unbounded strcpy can corrupt the stack and crash the reader.

What can be done if updating is not immediately possible?

Do not open EPUB or DAISY books from untrusted sources, particularly files that have not been reviewed or obtained through trusted distribution channels. The provided data identifies crafted book content as the trigger.

CVE-2026-123199: eBook-speaker through 6.2.0 Stack-based Buffer Overflow via element name attribute

Event History

Frequently Asked Questions

Who is exposed to this vulnerability?

What must an attacker provide to trigger the issue?

What can be done if updating is not immediately possible?

Company

Resources

Contact

Frequently Asked Questions

Who is exposed to this vulnerability?

What must an attacker provide to trigger the issue?

What can be done if updating is not immediately possible?