CVE-2026-124553: BabelDOC from 0.3.61 before 0.7.0 Denial of Service via ToUnicode CMap Parsing
BabelDOC from 0.3.61 before 0.7.0 contains a resource exhaustion vulnerability that allows remote attackers to exhaust CPU and memory by supplying unbounded bfrange and cidrange spans. Attackers can submit a crafted PDF whose embedded ToUnicode CMap declares a huge range, driving billions of loop iterations and stalling the translation worker.
Event History
Frequently Asked Questions
Which deployments are exposed?
BabelDOC installations running versions from 0.3.61 up to, but not including, 0.7.0 are affected when they process attacker-supplied PDFs. The vulnerable parsing occurs in the translation worker.
What does an attacker need to exploit this issue?
An unauthenticated remote attacker only needs to supply a crafted PDF containing an embedded ToUnicode CMap with an unbounded bfrange or cidrange span. No user interaction or privileges are required.
What is the operational impact?
Processing the malicious PDF can consume CPU and memory through billions of loop iterations, stalling the translation worker. The described impact is denial of service; no confidentiality or integrity impact is indicated.
What can be done if upgrading is not immediately possible?
The provided information supports limiting or preventing processing of untrusted PDFs until an upgrade can be performed. In particular, avoid submitting PDFs from untrusted sources to affected translation workers.