CVE-2025-64486
CVE-2025-64486 · calibre is vulnerable to arbitrary code execution when opening FB2 files
This page contains facts from public vulnerability sources. Check the original advisory before updating.
calibre is an e-book manager. In versions 8.13.0 and prior, calibre does not validate filenames when handling binary assets in FB2 files, allowing an attacker to write arbitrary files on the filesystem when viewing or converting a malicious FictionBook file. This can be leveraged to achieve arbitrary code execution. This issue is fixed in version 8.14.0.
CVSS 9.3 · Critical · EPSS 0.2% · Fix available
- Published
- Updated
Stack: system
Affected products and versions
calibre
- Versions
- < 8.14.0: Affected
No fix published
calibre Debian:12
- Versions
- 6.13.0+repack-2
- 6.13.0+repack-2+deb12u1
- 6.13.0+repack-2+deb12u2
- 6.13.0+repack-2+deb12u3
- 6.13.0+repack-2+deb12u4
- Affected ranges
- ECOSYSTEM: < 6.13.0+repack-2+deb12u5
Update to 6.13.0+repack-2+deb12u5
calibre Debian:13
- Versions
- 8.5.0+ds-1
- Affected ranges
- ECOSYSTEM: < 8.5.0+ds-1+deb13u1
Update to 8.5.0+ds-1+deb13u1
calibre Debian:14
- Versions
- 8.10.0+ds-1
- 8.10.0+ds-2
- 8.10.0+ds-3
- 8.11.0+ds+~0.10.5-1
- 8.11.1+ds+~0.10.5-1
- 8.11.1+ds+~0.10.5-2
- 8.11.1+ds+~0.10.5-3
- 8.12.0+ds+~0.10.5-1
- 8.13.0+ds+~0.10.5-1
- 8.13.0+ds+~0.10.5-2
- 8.13.0+ds+~0.10.5-3
- 8.14.0+ds+~0.10.5-1~bpo13+1
- 8.5.0+ds-1
- 8.6.0+ds-1
- 8.7.0+ds-1
- 8.8.0+ds-1
- 8.8.0+ds-2
- 8.8.0+ds-2+gcc15
- 8.8.0+ds-3
- 8.9.0+ds-1
- 8.9.0+ds-2
- 8.9.0+ds-3
- 8.9.0+ds-4
- Affected ranges
- ECOSYSTEM: < 8.14.0+ds+~0.10.5-1
Update to 8.14.0+ds+~0.10.5-1
calibre Ubuntu:16.04:LTS
- Versions
- 2.33.0+dfsg-1build1
- 2.38.0+dfsg-1
- 2.45.0+dfsg-1
- 2.45.0+dfsg-1build1
- 2.48.0+dfsg-1
- 2.48.0+dfsg-1build1
- 2.54.0+dfsg-1
- 2.55.0+dfsg-1
- 2.55.0+dfsg-1ubuntu0.2
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
calibre Ubuntu:18.04:LTS
- Versions
- 3.7.0+dfsg-2
- 3.7.0+dfsg-2build1
- 3.12.0+dfsg-1
- 3.13.0+dfsg-1
- 3.14.0+dfsg-1
- 3.15.0.1+dfsg-1
- 3.16.0+dfsg-1
- 3.16.0+dfsg-1build1
- 3.17.0+dfsg-1
- 3.17.0+dfsg-2
- 3.18.0+dfsg-1build1
- 3.19.0+dfsg-1
- 3.20.0+dfsg-1
- 3.21.0+dfsg-1
- 3.21.0+dfsg-1build1
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
calibre Ubuntu:20.04:LTS
- Versions
- 3.46.0+dfsg-1
- 4.2.0+dfsg-2
- 4.3.0+dfsg-1
- 4.3.0+dfsg-2
- 4.4.0+dfsg-1
- 4.5.0+dfsg-1
- 4.5.0+dfsg-2
- 4.5.0+dfsg-3
- 4.6.0+dfsg-1
- 4.7.0+dfsg-1
- 4.99.3+dfsg-2
- 4.99.4+dfsg-1
- 4.99.4+dfsg-1build1
- 4.99.4+dfsg+really4.10.0+py3-2
- 4.99.4+dfsg+really4.11.2-1
- 4.99.4+dfsg+really4.11.2-1build1
- 4.99.4+dfsg+really4.12.0-1
- 4.99.4+dfsg+really4.12.0-1build1
- 4.99.4+dfsg+really4.12.0-1ubuntu1
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
calibre Ubuntu:22.04:LTS
- Versions
- 5.25.0+dfsg-2
- 5.33.2+dfsg-1
- 5.34.0+dfsg-1
- 5.35.0+dfsg-1ubuntu2
- 5.37.0+dfsg-1
- 5.37.0+dfsg-1build1
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
calibre Ubuntu:24.04:LTS
- Versions
- 6.24.0+ds-1
- 6.29.0+ds-1
- 7.0.0+ds-1
- 7.1.0+ds-1
- 7.1.0+ds-2
- 7.2.0+ds-1
- 7.2.0+ds-1build1
- 7.3.0+ds-1
- 7.4.0+ds-1
- 7.5.1+ds-1
- 7.5.1+ds-2
- 7.5.1+ds-3
- 7.6.0+ds-1
- 7.6.0+ds-1build1
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
calibre Ubuntu:25.10
- Versions
- 7.26.0+ds-4build1
- 8.3.0+ds-1
- 8.4.0+ds-1
- 8.5.0+ds-1
- 8.6.0+ds-1
- 8.7.0+ds-1
- 8.8.0+ds-2
- 8.8.0+ds-3
- 8.8.0+ds-3build1
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
calibre Ubuntu:26.04:LTS
- Versions
- 8.8.0+ds-3build1
- 8.13.0+ds+~0.10.5-3
- 8.14.0+ds+~0.10.5-1
- 8.15.0+ds+~0.10.5-1
- 8.16.0+ds+~0.10.5-2
- 8.16.2+ds+~0.10.5-1
- 8.16.2+ds+~0.10.5-2
- 8.16.2+ds+~0.10.5-3
- 9.2.1+ds+~0.10.5-2build1
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published