01 Record

CVE-2026-124553

BabelDOC from 0.3.61 before 0.7.0 Denial of Service via ToUnicode CMap Parsing

HighPUBLISHEDCNA: VulnCheck

CNA base score8.7 CVSS v4.0CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

View raw JSON

02 Description

BabelDOC from 0.3.61 before 0.7.0 Denial of Service via ToUnicode CMap Parsing

03 Exploitation and scoring

Exploitation: Not assessed. CISA has not published an exploitation assessment for this record, and it is not in the KEV catalog. That is an absence of assessment, not a finding of no risk.
SSVC decision: Not assessed by CISA
EPSS probability: Not scored by EPSS
EPSS percentile: Not scored by EPSS
NVD base score: The NVD has published no score for this record
NVD CVSS vector: No NVD score to derive
NVD analysis status: Not recorded
Red Hat severity: No Red Hat rating. Red Hat rates the CVEs that affect its products.

Exploit-prediction scores from FIRST. Independent scoring and analysis status from the NVD. Vendor severity from Red Hat. Exploitation assessment and catalog membership from CISA.

04 Metadata

Published

2026-11-08 14:12Z1 HR AGO

Last updated

2026-11-08 14:12Z1 HR AGO

Reserved

2026-11-08

Assigning CNA

VulnCheck

Record state

PUBLISHED

Severity

High (CVSS 8.7)

CNA CVSS vector

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

Weaknesses

CWE-770Allocation of Resources Without Limits or ThrottlingBase

Data version

5.2

Document digest

347a2fc4278df1f9f9db86261b5a33fec93069707895413c84e386e9852e5994

05 Affected products

VendorProductVersionsPlatforms

funstory-aiBabelDOC0.3.61 to < 0.7.0—

06 References

github.comGitHub Security Advisory (GHSA-wrv8-h9rp-6fqq)https://github.com/funstory-ai/BabelDOC/security/advisories/GHSA-wrv8-h9rp-6fqqvendor-advisory
github.comhttps://github.com/funstory-ai/BabelDOC/commit/39a6e9eafeecd39404b94b2f71e88ea058753dd5patch
github.comhttps://github.com/funstory-ai/BabelDOC/blob/main/docs/release-notes/v0.7.0.mdrelease-notes
github.comhttps://github.com/funstory-ai/BabelDOC/blob/v0.6.4/babeldoc/pdfminer/cmapdb.py#L378-L389technical-description
github.comhttps://github.com/funstory-ai/BabelDOC/blob/v0.6.4/babeldoc/format/pdf/new_parser/runtime/to_unicode_parser_runtime.py#L150-L158technical-description
www.vulncheck.comVulnCheck Advisory: BabelDOC from 0.3.61 before 0.7.0 Denial of Service via ToUnicode CMap Parsinghttps://www.vulncheck.com/advisories/babeldoc-from-0.3.61-before-0.7.0-denial-of-service-via-tounicode-cmap-parsingthird-party-advisory