Critical Calibre Flaw (CVE-2025-64486, CVSS 9.3) Allows RCE via Malicious FB2 E-book

Calibre, the cross‑platform e‑book manager, is vulnerable to arbitrary code execution when a specially crafted FictionBook FB2 file is viewed or converted, tracked as CVE-2025-64486 with a CVSS of 9.3 and affecting releases up to 8.13.0, fixed in 8.14.0. The flaw arises because Calibre does not validate filenames when handling binary assets in FB2 files, enabling an attacker to write arbitrary files to the filesystem and potentially run executable payloads or override DLLs.

In practical terms, a poisoned FB2 file delivered via email, a forum download, a torrent, or a compromised website could let an attacker gain code execution on the victim’s machine. Researchers describe that crafted FB2s may carry binary assets with filenames designed to cause writes to unintended locations, which can then be leveraged to execute code.

Users are advised to patch to Calibre 8.14.0 and to treat untrusted FB2 files as potentially malicious until updates have been applied and audited, according to the advisory GHSA-hpwq-c98h-xp8g.