CVE-2026-123199 in eBook-speaker

Summary

by MITRE • 11/05/2026

eBook-speaker 6.1.0 through 6.2.0 contains a stack buffer overflow vulnerability in get_attributes() in src/common.c caused by an unbounded strcpy of an element's name attribute. Attackers can craft an EPUB or DAISY book with a name attribute of 511 or more characters to corrupt the stack and crash the reader when opened.

Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

• Responsible: VulnCheck
• Reservation: 11/05/2026
• Disclosure: 11/05/2026
• Moderation: accepted
• Entry: VDB-431592
• CPE: 20261105
• CWE: CWE-121 (confirmed)
• CVSS: 5.5 (CNA)
• EPSS: 0.00000
• KEV: no
• Activities: very low

Sources

• MITRE: https://www.cve.org/CVERecord?id=CVE-2026-123199
• NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-123199
• CVE Details: https://www.cvedetails.com/cve/CVE-2026-123199/