BlogPHP2Shell Exploitation: How Secure.com Can Protect YouRead more
← CVE Radar

CVE-2026-123199eBook-speaker through 6.2.0 Stack-based Buffer Overflow via element name attribute

eBook-speaker 6.1.0 through 6.2.0 contains a stack buffer overflow vulnerability in get_attributes() in src/common.c caused by an unbounded strcpy of an element's name attribute. Attackers can craft an EPUB or DAISY book with a name attribute of 511 or more characters to corrupt the stack and crash the reader when opened.

6.8 MEDIUMEPSS 0.14%Not in KEVNVD: Received

OverviewAffected ProductsReferences
NVD CVE.org

Overview

Severity

ScoreSeverityVersionVector String
6.8MEDIUM4.0VulnCheck (CNA)CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
5.5MEDIUM3.1VulnCheck (CNA)CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

Details

CVE ID
CVE-2026-123199
Status
Received
Assigner (CNA)
VulnCheck
Published
Nov 5, 2026
Last modified
2026-11-05 19:17 UTC
Weaknesses
  • CWE-120 · Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')

Sources

Refreshed hourly from the sources above. Last fetched 2026-11-08 07:37 UTC.