An integer overflow vulnerability exists in the EPUB archive parser of the libgepub library. In the gepub_archive_read_entry() function, a 64-bit size value from archive_entry_size() is incorrectly cast to a 32-bit signed integer (gint). When processing a specially crafted EPUB file with a large declared file size, the value can wrap into a negative integer. This is subsequently passed to g_malloc0(), resulting in a very large unsigned allocation attempt that fails and causes a crash.

This can lead to denial of service in applications using libgepub. The issue has been observed in desktop components such as tumbler, where merely browsing a directory containing a crafted EPUB file may trigger the bug. No known web-facing services are confirmed to be affected, but the library could be used in such contexts.