CVE-2026-124553
Deferred Deferred - Pending Action

BabelDOC Resource Exhaustion via Malicious PDF

Publication date: 2026-11-08

Last updated on: 2026-11-08

Assigner: VulnCheck

Description
BabelDOC from 0.3.61 before 0.7.0 contains a resource exhaustion vulnerability that allows remote attackers to exhaust CPU and memory by supplying unbounded bfrange and cidrange spans. Attackers can submit a crafted PDF whose embedded ToUnicode CMap declares a huge range, driving billions of loop iterations and stalling the translation worker.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-11-08
Last Modified
2026-11-08
Generated
2026-11-08
AI Q&A
2026-11-08
EPSS Evaluated
N/A
NVD
CVE-2026-124553
EUVD
EUVD-2026-119609

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
funstory-ai BabelDOC From 0.3.61 (inc) to 0.7.0 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-770 The product allocates a reusable resource or group of resources on behalf of an actor without imposing any intended restrictions on the size or number of resources that can be allocated.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability affects BabelDOC versions before 0.7.0. It allows remote attackers to cause resource exhaustion by submitting crafted PDFs with unbounded bfrange and cidrange spans in the ToUnicode CMap. This triggers billions of loop iterations, consuming excessive CPU and memory, leading to denial-of-service conditions or crashes.

Detection Guidance

Monitor for unusual CPU or memory spikes during PDF processing, particularly when handling files with embedded ToUnicode CMaps. Check BabelDOC version with `pip show babeldoc` or inspect logs for parsing errors related to bfrange or cidrange operations.

Impact Analysis

If exploited, this vulnerability can stall or crash the BabelDOC translation worker, disrupting document processing services. It may cause high CPU and memory usage, leading to system slowdowns or outages. Users running vulnerable versions should upgrade to 0.7.0 or later to mitigate risks.

Compliance Impact

This vulnerability primarily impacts availability by causing resource exhaustion, which could lead to system crashes or denial-of-service conditions. While not directly violating GDPR or HIPAA, such disruptions may hinder compliance with requirements for data availability and integrity. Organizations processing sensitive data (e.g., health records under HIPAA or personal data under GDPR) could face operational failures, potentially affecting access to critical information.

Mitigation Strategies

Upgrade BabelDOC to version 0.7.0 or later. If upgrading is not possible, isolate PDF parsing in constrained environments with memory and CPU limits. Disable or restrict access to PDF processing features until patched.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-124553. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart

Security Radar

News mentioning this vulnerability
Loading related security news...