CVE-2026-73248 kovidgoyal CVE debrief

Who should care

Defenders responsible for managing e-book libraries using calibre should assess exposure and prioritize updating to version 9.12.0 or later. This vulnerability affects e-book library management systems and requires verification of calibre version and potential updates. Security teams should review the vulnerability and implement necessary mitigations to prevent exploitation.

Why it matters

Defenders should prioritize updating calibre to version 9.12.0 or later to prevent arbitrary Python code execution when processing malicious files. This vulnerability affects e-book library management systems and requires verification of calibre version and potential updates.

• Arbitrary Python code execution when processing malicious files
• Potential for compromise of e-book library management systems
• Need for verification of calibre version and update to 9.12.0 or later
• Monitoring for suspicious activity related to calibre

Technical summary

The vulnerability exists in calibre versions prior to 9.12.0 due to improper handling of composite_template metadata from malicious EPUB, OPF, PDF, or similar files. This can lead to arbitrary Python code execution when the file is opened or imported. The issue is fixed in version 9.12.0. Users should verify their calibre version and update if necessary to prevent exploitation. The vulnerability affects e-book library management systems and requires verification of calibre version and potential updates. The source confidence is high based on the CVE record and official advisory.

Defensive priority

Defenders should prioritize updating calibre to version 9.12.0 or later to prevent arbitrary Python code execution.

Recommended defensive actions

• Update calibre to version 9.12.0 or later
• Verify calibre version and update if necessary
• Monitor for suspicious activity related to calibre
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The vulnerability exists in calibre versions prior to 9.12.0. The issue is fixed in version 9.12.0. Users should verify their calibre version and update if necessary. The vulnerability is caused by improper handling of composite_template metadata from malicious EPUB, OPF, PDF, or similar files. This can lead to arbitrary Python code execution when the file is opened or imported. The source confidence is high based on the CVE record and official advisory.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.