CVE-2025-64486 - CVE House
Back to Database
Status published Critical CVE-2025-64486

calibre is vulnerable to arbitrary code execution when opening FB2 files

Vulnerability Description

calibre is an e-book manager. In versions 8.13.0 and prior, calibre does not validate filenames when handling binary assets in FB2 files, allowing an attacker to write arbitrary files on the filesystem when viewing or converting a malicious FictionBook file. This can be leveraged to achieve arbitrary code execution. This issue is fixed in version 8.14.0.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2025-64486

Credits & Attribution

No credits recorded in the NVD database.

References

More from kovidgoyal

View All →
CVE-2020-35605
The Graphics Protocol feature in graphics.c in kitty before 0.19.3...
Critical 9.8

Affected Vendor

Affected Software

calibre
Vulnerable Versions:
< 8.14.0

Timeline

Official Publish: November 7th, 2025
Last Modified: November 13th, 2025
Added to House: July 22nd, 2026

CVSS Vectors

Weaknesses (CWE)

CWE-73

MITRE ATT&CK TTPs

T1190 Exploit Public-Facing Application
Initial Access
T1005 Data from Local System
Collection
T1105 Ingress Tool Transfer
Command and Control
T1574 Hijack Execution Flow
Privilege Escalation
T1565 Data Manipulation
Impact