Based on the CVE description, an attacker can exploit improper path validation in calibre's PDB readers to write files of any name and content outside the intended directory. Files are opened in binary write mode, silently overwriting existing ones, enabling the replacement of legitimate binaries or the deployment of malicious code. The vulnerability allows arbitrary file writes anywhere the user has write permissions, potentially facilitating code execution and causing denial of service through corruption.

The flaw is present in calibre 9.2.1 and all earlier releases. Users running these versions on any platform that permits the installation of calibre are affected. The issue is resolved in calibre 9.3.0 and later.

The CVSS score of 9.3 indicates high severity. EPSS is below 1%, suggesting few current exploits, but the risk is real, especially with the potential for local code execution if a user runs a crafted PDB file. The vulnerability is not listed in CISA's KEV catalog, yet its impact warrants immediate attention. The likely attack vector is the delivery of a malicious PDB file that an authorized user opens with calibre; this inference comes from the description that the flaw allows local file writes without network exposure. Elevated local privileges would further increase the danger.