CVE-2025-64486CWE-73

calibre is vulnerable to arbitrary code execution when opening FB2 files

Critical · published November 7, 2025

CVSS v4.0
9.3
EPSS
0%
Percentile
8.3
In the wild
Unconfirmed
What it is

calibre is an e-book manager. In versions 8.13.0 and prior, calibre does not validate filenames when handling binary assets in FB2 files, allowing an attacker to write arbitrary files on the filesystem when viewing or converting a malicious FictionBook file. This can be leveraged to achieve arbitrary code execution. This issue is fixed in version 8.14.0.

The record
Technical detail
CVSS v4.0
9.3 · CRITICAL
Vector
CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H
EPSS
0.00191 · 8.3th percentile
Weakness
CWE-73 · External Control of File Name or Path
Published
2025-11-07T23:25Z
EPSS history
Timeline
  • 07 NOV 23:25Z
    calibre is vulnerable to arbitrary code execution when opening FB2 files
    cvelistv5