Description

eBook-speaker 6.1.0 through 6.2.0 contains a stack buffer overflow vulnerability in get_attributes() in src/common.c caused by an unbounded strcpy of an element's name attribute. Attackers can craft an EPUB or DAISY book with a name attribute of 511 or more characters to corrupt the stack and crash the reader when opened.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "5.5",
  "pubDate": "2026-11-05T19:17:18.763Z",
  "pubdate": "2026-11-05T19:17:18.763Z",
  "executiveSummary": "eBook-speaker versions 6.1.0 through 6.2.0 are susceptible to a stack-based buffer overflow vulnerability located in the get_attributes() function within src/common.c.\nThe vulnerability arises from the insecure use of the strcpy function when processing the name attribute of elements within EPUB or DAISY book files.\nAn unauthenticated attacker can exploit this flaw by supplying a specially crafted file containing a malicious name attribute exceeding 511 characters.\nSuccessful exploitation results in memory corruption on the stack, which can lead to application crashes or potentially arbitrary code execution depending on the attacker's ability to control the instruction pointer.\nThis vulnerability poses a significant risk to user integrity, as processing untrusted eBook files could lead to a denial-of-service condition or system compromise.\nNo specific authentication or specialized privileges are required beyond the ability to induce a user to open a malicious file with the vulnerable reader application.",
  "technicalDetails": "The vulnerability is a classic stack-based buffer overflow stemming from an unbounded memory copy operation performed during the parsing of metadata attributes in eBook-speaker versions 6.1.0 through 6.2.0.\nThe root cause is identified within src/common.c in the get_attributes() function. The implementation utilizes the strcpy function to copy the contents of an element's 'name' attribute into a fixed-size stack buffer without performing any boundary checks on the input length.\nIn C-based applications, strcpy does not verify if the destination buffer is sufficient to hold the source string, leading to an overflow if the source input exceeds the allocated stack memory space. For this specific implementation, a payload of 511 or more characters is sufficient to exceed the buffer capacity.\nThe attack flow begins when the victim opens a malicious EPUB or DAISY formatted book file using the eBook-speaker application. The parser, specifically the logic inside get_attributes(), encounters an element containing a name attribute designed to trigger the overflow.\nAs the application copies the maliciously crafted string, the data exceeds the buffer boundary and overwrites adjacent memory on the stack. This typically includes saved frame pointers and the return address of the function.\nBy precisely controlling the content of the overflow, an attacker can overwrite the saved instruction pointer (return address) on the stack. When the get_attributes() function finishes execution, the CPU will attempt to resume control at an address dictated by the corrupted stack value rather than the original return address.\nWhile the immediate impact observed is an application crash due to illegal memory access (segmentation fault), the flaw permits the injection of malicious payloads. An attacker capable of placing shellcode on the stack or utilizing return-oriented programming (ROP) chains may be able to redirect program flow to execute arbitrary code with the permissions of the eBook-speaker process.\nThis vulnerability is triggered locally upon the ingestion of a malformed file, making it a critical threat for users who frequently open files from untrusted sources. There is no requirement for network interaction, as the attack is fully weaponized via the file format itself."
}