UBUNTU-CVE-2026-123199: Buffer Overflow

Published Nov 6, 2026

Updated

eBook-speaker 6.1.0 through 6.2.0 contains a stack buffer overflow vulnerability in getattributes() in src/common.c caused by an unbounded strcpy of an element's name attribute. Attackers can craft an EPUB or DAISY book with a name attribute of 511 or more characters to corrupt the stack and crash the reader when opened.

Affected Software

7 affected components

ubuntu/ebook-speaker*

Event History

Nov 6, 2026

CVE Published

via OSV·12:00 AM

Data Sourced

via OSV·12:00 AM

DescriptionSeverityAffected Software

Frequently Asked Questions

What user interaction is required for exploitation?

An attacker must provide a crafted EPUB or DAISY book and have it opened in eBook-speaker. The malicious book needs an element name attribute of 511 or more characters.

What is the known impact of a successful exploit?

The overflow can corrupt the stack and crash the reader when the crafted book is opened.

Which versions are identified as affected?

The affected range is eBook-speaker 6.1.0 through 6.2.0.

UBUNTU-CVE-2026-123199: Buffer Overflow

Affected Software

Event History

Frequently Asked Questions

What user interaction is required for exploitation?

What is the known impact of a successful exploit?

Which versions are identified as affected?

Company

Resources

Contact

Frequently Asked Questions

What user interaction is required for exploitation?

What is the known impact of a successful exploit?

Which versions are identified as affected?