CVE-2026-124553 in BabelDOC
Summary
by MITRE • 11/08/2026
BabelDOC from 0.3.61 before 0.7.0 contains a resource exhaustion vulnerability that allows remote attackers to exhaust CPU and memory by supplying unbounded bfrange and cidrange spans. Attackers can submit a crafted PDF whose embedded ToUnicode CMap declares a huge range, driving billions of loop iterations and stalling the translation worker.
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 11/08/2026
The BabelDOC library, specifically in versions prior to 0.7.0, contains a critical resource exhaustion vulnerability that stems from insufficient validation of input data within PDF parsing routines. This flaw allows remote attackers to trigger severe performance degradation or complete denial of service by supplying maliciously crafted Portable Document Format files. The core technical issue lies in the handling of ToUnicode CMap entries, which are used to map character codes to Unicode values for text extraction and translation purposes. When a PDF contains embedded CMaps that declare excessively large ranges through bfrange and cidrange spans, the library fails to enforce reasonable bounds on these values before processing them.
The operational impact of this vulnerability is significant because it directly impacts system stability by driving billions of loop iterations during the parsing process. Instead of validating whether the declared range size is feasible or within expected limits for a given document context, BabelDOC proceeds with unbounded iteration logic based solely on the numeric values provided in the CMap definition. This behavior results in excessive consumption of central processing unit cycles and memory resources as the system attempts to resolve mappings across an artificially inflated scope. Attackers can exploit this by submitting documents where these range declarations are deliberately exaggerated, effectively stalling translation workers or crashing applications that rely on BabelDOC for document analysis.
From a classification perspective, this vulnerability aligns with CWE-400, which describes uncontrolled resource consumption due to insufficient control over the allocation and management of resources such as memory, file descriptors, or CPU time. The attack vector is categorized under ATT&CK technique T1496, Resource Hijacking, specifically involving environmental hijacking where an attacker manipulates system resources to degrade service availability for legitimate users. This type of flaw highlights a common pattern in document processing libraries where performance optimizations are prioritized over robust input validation, leaving systems vulnerable to denial-of-service attacks via malformed inputs rather than requiring complex exploitation chains or authentication bypasses.
Mitigation strategies should focus on immediate patching and defensive coding practices. Organizations using BabelDOC must upgrade to version 0.7.0 or later where these bounds checking mechanisms have been implemented to prevent unbounded iterations based on CMap range declarations. In the interim, if upgrading is not immediately feasible, deploying input validation filters at the network perimeter can help block PDFs with suspiciously large numeric values in their metadata structures before they reach the processing engine. Additionally, implementing resource limits such as CPU time quotas and memory caps for document parsing services can mitigate the impact of such attacks by ensuring that even if an exploit is attempted, it will be terminated gracefully rather than causing systemic failure. Regular security audits focusing on input validation logic within third-party libraries are essential to identify similar vulnerabilities in other components of the software stack.