CVE-2026-44019

HighCVSS 8.1

Published: 16/07/2026(UTC)Updated: 17/07/2026(UTC)Translated: 18/07/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.24%

14th percentile - higher than 14% of all known CVEs

Summary

A vulnerability in Docling Core (versions 2.5.0 through 2.74.0) allows local file:// image references and accepts inline data: content without a decoded-size limit. This may lead to unauthorized file access or excessive memory consumption.

Risk Assessment

The organization risks local sensitive data leakage and denial-of-service attacks via large inline payloads if the application processes untrusted image references.

Recommendation

Immediately upgrade Docling Core to version 2.74.1 or later and restrict acceptance of external image references in the application.

Other vulnerabilities in Docling Core

CVE-2026-44023High
Docling Core versions 1.5.0 through 2.74.1 insufficiently restricted remote request destinations and unsafely processed Content-Disposition headers, allowing access to local files outside the cache directory. This vulnerability enables SSRF attacks in applications that accept untrusted URLs.

Original NVD description (English source)

Docling Core defines core data types and transformations for the document processing application Docling. In versions 2.5.0 and above, prior to 2.74.1, docling-core could allow local file:// image references and accepted inline data: content without a decoded-size limit. In applications that accept untrusted image references, this may allow access to local files readable by the process or excessive memory use from large inline payloads. This issue has been fixed in version 2.74.1.