What is CVE-2025-6196?

CVE-2025-6196 is a medium-severity vulnerability in Gnome Libgepub, classified under Integer Overflow or Wraparound. CVSS score: 5.5/10. Published 2025-06-17.

How severe is CVE-2025-6196?

Medium severity. CVSS v3 base score is 5.5 out of 10.

Integer overflow in Gnome Libgepub

CVE-2025-6196

A flaw was found in libgepub, a library used to read EPUB files. The software mishandles file size calculations when opening specially crafted EPUB files, leading to incorrect memory allocations. This issue causes the application to crash. Known affected usage includes desktop services like Tumbler, which may process malicious files automatically when browsing directories. While no direct remote attack vectors are confirmed, any application using libgepub to parse user-supplied EPUB content could be vulnerable to a denial of service.

Vulnerability class: Integer Overflow

EPSS: 0.002 (9.1th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 5.5 (Medium). Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H.

Affected products

Weakness classification (CWE)

CWE-190 — Integer Overflow or Wraparound

References

secalert@redhat.com (x_refsource_REDHAT, Third Party Advisory, Mitigation, vdb-entry)
secalert@redhat.com (x_refsource_REDHAT, issue-tracking, Third Party Advisory, Issue Tracking)
secalert@redhat.com (Exploit, Third Party Advisory, Issue Tracking)

Frequently asked questions

What is CVE-2025-6196?: CVE-2025-6196 is a medium-severity vulnerability in Gnome Libgepub, classified under Integer Overflow or Wraparound. CVSS score: 5.5/10. Published 2025-06-17.
How severe is CVE-2025-6196?: Medium severity. CVSS v3 base score is 5.5 out of 10.