CVE-2026-18929
Received Received - Intake

Denial of Service in Carbone via Zip Bomb in DOCX Processing

Publication date: 2026-08-18

Last updated on: 2026-08-18

Assigner: CERT.PL

Description
Carbone is vulnerable to Denial of Service due to lack of protection against zip bombs when processing .docx files. The library uses yazl for zip decompression without validating entry sizes, allowing an attacker to supply a malicious .docx file containing a zip bomb that decompresses to a significantly larger size, causing excessive memory consumption and crashing the application server. The issue was fixed in versions: 3.8.2, 4.26.3 and 5.4.4.  The fix is available across all distribution types.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-18
Last Modified
2026-08-18
Generated
2026-08-18
AI Q&A
2026-08-18
EPSS Evaluated
N/A
NVD
CVE-2026-18929
EUVD
EUVD-2026-60574

Affected Vendors & Products

Showing 4 associated CPEs
Vendor Product Version / Range
carbone carbone 3.8.2
carbone carbone 4.26.3
carbone carbone 5.4.4
carbone carbone to 5.4.4 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-409 The product does not handle or incorrectly handles a compressed input with a very high compression ratio that produces a large output.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-18929 is a Denial of Service vulnerability in the Carbone software. It occurs when processing .docx files due to improper handling of highly compressed data. The software uses the yazl library for zip decompression without validating entry sizes, allowing attackers to supply malicious .docx files containing zip bombs. These zip bombs decompress to an abnormally large size, consuming excessive memory and crashing the application server.

Detection Guidance

Detecting this vulnerability requires checking if your Carbone software version is below 3.8.2, 4.26.3, or 5.4.4. Inspect installed versions via package managers or application logs. Monitor for crashes when processing .docx files, as excessive memory usage during decompression may indicate a zip bomb attack.

Impact Analysis

This vulnerability can cause application servers to crash due to excessive memory consumption from decompressing malicious .docx files. It may lead to service unavailability, downtime, and potential data loss if the server fails to recover properly. Users relying on Carbone for document generation could experience disruptions in their workflows.

Mitigation Strategies

Upgrade Carbone to version 3.8.2, 4.26.3, or 5.4.4 or later immediately. If upgrading is not possible, restrict .docx file processing to trusted sources only and implement memory limits during decompression to prevent DoS conditions.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-18929. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart