The vulnerability is a stack‑based buffer overflow caused by an unbounded strcpy of an element’s name attribute in the get_attributes() function. Exploitation can corrupt the stack and crash the eBook‑speaker application, leading to a denial of service for the user. The weakness is classified as CWE‑120.

The defect exists in the eBook‑speaker application, version 6.1.0 through 6.2.0. No other versions are listed as affected.

The CVSS score for this issue is 6.8, indicating moderate severity. EPSS exploitation likelihood is not available and the vulnerability is not listed in the CISA KEV catalog. The likely attack vector is that an attacker supplies a crafted EPUB or DAISY book containing a name attribute with 511 or more characters; when the book is opened on a device running the vulnerable application, the overflow occurs. This attack requires the victim to open the malicious file and therefore is considered a file‑based local or remote attack depending on whether the device is compromised.