Bug 2373117 (CVE-2025-6196)

Summary: CVE-2025-6196 libgepub: Integer Overflow in libgepub's EPUB Archive Handling
Product: [Other] Security Response Reporter: OSIDB Bzimport <bzimport>
Component: vulnerabilityAssignee: Product Security DevOps Team <prodsec-dev>
Status: NEW --- QA Contact:
Severity: medium Docs Contact:
Priority: medium    
Version: unspecifiedKeywords: Security
Target Milestone: ---   
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: Doc Type: ---
Doc Text:
A flaw was found in libgepub, a library used to read EPUB files. The software mishandles file size calculations when opening specially crafted EPUB files, leading to incorrect memory allocations. This issue causes the application to crash. Known affected usage includes desktop services like Tumbler, which may process malicious files automatically when browsing directories. While no direct remote attack vectors are confirmed, any application using libgepub to parse user-supplied EPUB content could be vulnerable to a denial of service.
 Story Points: ---
Clone Of: Environment:
Last Closed: Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:
Bug Depends On: 2373118, 2373122    
Bug Blocks:    

Description OSIDB Bzimport 2025-06-17 06:52:18 UTC 
An integer overflow vulnerability exists in the EPUB archive parser of the libgepub library. In the gepub_archive_read_entry() function, a 64-bit size value from archive_entry_size() is incorrectly cast to a 32-bit signed integer (gint). When processing a specially crafted EPUB file with a large declared file size, the value can wrap into a negative integer. This is subsequently passed to g_malloc0(), resulting in a very large unsigned allocation attempt that fails and causes a crash.

This can lead to denial of service in applications using libgepub. The issue has been observed in desktop components such as tumbler, where merely browsing a directory containing a crafted EPUB file may trigger the bug. No known web-facing services are confirmed to be affected, but the library could be used in such contexts.