CVE-2026-26065

An attacker provides a specially crafted file in PDB format, which when processed by Calibre causes a file to be written outside the intended working directory — without restrictions on file extension or content. Writing occurs in 'wb' mode (binary overwrite), meaning existing files are silently overwritten without warning. The vulnerability affects both supported PDB header variants (132-byte and 202-byte). An appropriately crafted payload can, for example, overwrite a startup script or other executable file, leading to RCE or permanent data corruption.

An attacker can write a file with arbitrary content and extension to any location in the file system accessible to the Calibre process, which may result in malicious code execution (RCE) or damage to critical files (DoS).

Calibre should be updated to version 9.3.0, in which the vulnerability has been fixed. The patch is available in the project repository (commit b6da1c3878c06eb1356cb0ec1106cb66e0e9bfb8). Until the update is applied, it is recommended to avoid opening PDB files from untrusted sources.

Calibre in versions 9.2.1 and earlier (all platforms supported by Calibre)