CVE-2026-123199 eBook-speaker through 6.2.0 Stack-based Buffer Overflow via element name attribute

Medium 6.8 Published 5 Nov 2026 Updated 9 Nov 2026

Exploited in the wild: Not known
Fix: None listed

What is CVE-2026-123199?

CVE-2026-123199 is a medium-severity vulnerability in book-readers eBook-speaker, published on 5 Nov 2026.

Official description

eBook-speaker 6.1.0 through 6.2.0 contains a stack buffer overflow vulnerability in get_attributes() in src/common.c caused by an unbounded strcpy of an element's name attribute. Attackers can craft an EPUB or DAISY book with a name attribute of 511 or more characters to corrupt the stack and crash the reader when opened.

Weakness: CWE-120

Which versions are affected by CVE-2026-123199?

How do I fix CVE-2026-123199?

No fix has been published for CVE-2026-123199 yet. Limit exposure of the affected software until one is available.

Is CVE-2026-123199 being exploited?

There is no known exploitation of CVE-2026-123199 in the wild and no public exploit code.

Sources

Also known as DEBIAN-CVE-2026-123199, GHSA-fpw6-9pxv-22cx, UBUNTU-CVE-2026-123199.