Critical severity · published Nov 7, 2025
CVE-2025-64486
calibre is vulnerable to arbitrary code execution when opening FB2 files
9.3
CVSS
0.2%
EPSS
No
On KEV
Description
calibre is an e-book manager. In versions 8.13.0 and prior, calibre does not validate filenames when handling binary assets in FB2 files, allowing an attacker to write arbitrary files on the filesystem when viewing or converting a malicious FictionBook file. This can be leveraged to achieve arbitrary code execution. This issue is fixed in version 8.14.0.
Exploitation
Is it being used?
Exploit prediction (EPSS)0.2% · higher than 9% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
CA
calibre · kovidgoyal
< 8.14.0 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2025-64486
CVE.org
https://www.cve.org/CVERecord?id=CVE-2025-64486
github.com
https://github.com/kovidgoyal/calibre/commit/6f94bce214bf7d43c829804db3741afa5e83c0c5
github.com
https://github.com/kovidgoyal/calibre/security/advisories/GHSA-hpwq-c98h-xp8g
More from calibre
8.8
CVE-2026-26065
calibre: Path Traversal can Lead to Arbitrary File Write and Potential Code Execution
8.8
CVE-2026-26064
calibre: Path Traversal Vulnerability Enables Arbitrary File Write and Remote Code Execution
8.6
CVE-2026-25635
calibre has a Path Traversal Leading to Arbitrary File Write and Potential Code Execution
8.5
CVE-2026-73248
calibre: Bypass of Python template restrictions via nested `template()` leading to RCE
8.5
CVE-2026-53511
calibre: Arbitrary Code Execution in Template Formatter via Book Metadata