Linux Mint Xreader EUVD-2026-91986

Requires a victim to open an attacker-crafted EPUB file in Xreader version 4.6.5 or earlier using the built-in EPUB backend (backend/epub/epub-document.c). No authentication is required (PR:N), but exploitation is strictly gated by passive user interaction (UI:P) - the malicious EPUB must be delivered to and opened by the victim; there is no autonomous remote trigger. Exploitation is further limited to installations still carrying the EPUB backend: version 4.6.6 and later removed EPUB support entirely (reimplemented as the separate Xepub project), so upgraded systems are not affected. Impact is confined to low-confidentiality file disclosure (VC:L) with no integrity or availability effect.

This is a low-priority issue despite being remotely reachable. The official CVSS 4.0 base score is only 2.1, and the vector (AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:N/VA:N) tells a consistent story: although the attack vector is 'Network,' exploitation is passive-interaction-dependent (UI:P) - a victim must open an attacker-supplied EPUB file - and the only impact is low confidentiality (VC:L, no integrity or availability impact). Publicly available exploit code exists (a published gist and VulDB-tracked PoC), which raises practical feasibility, but there is no CISA KEV listing and no EPSS score was provided in the input, so there is no evidence of widespread or automated exploitation. Signals are internally consistent rather than conflicting: a path traversal (CWE-22) limited to file disclosure in a desktop document viewer, gated behind user interaction, is a genuine but minor bug. Notably, the maintainer states EPUB support was entirely removed from Xreader and reimplemented in Xepub, meaning upgraded installations no longer contain the vulnerable backend at all. EPSS is missing and should be checked to confirm the low expected-exploitation probability implied by the other signals.

An attacker crafts a malicious EPUB file containing path-traversal sequences in its internal content entries and distributes it via email, download, or a file-sharing site. When a victim opens the file in a vulnerable Xreader (≤4.6.5), the EPUB backend's path construction (g_strdup_printf in setup_document_content_list) resolves outside the intended extraction directory, enabling disclosure of files on the victim's system. Public exploit code is already available, lowering the barrier to reproduction.