Skip to content

Vendor

Carbone vulnerabilities

1 published CVE affecting Carbone, from public sources (CVE.org, NVD, CISA KEV, FIRST EPSS, OSV).

Total
1
Critical
0
High
0
Medium
1
Low
0
Unscored
0
CISA KEV
0
Atom feed of Carbone alerts

Products

Latest Carbone CVEs

Newest publication first

  1. CVE-2026-18929 Resource Exhaustion in Carbone

    Published
    MediumCVSS 6.9 EPSS 0.51%

    Carbone is vulnerable to Denial of Service due to lack of protection against zip bombs when processing .docx files. The library uses yazl for zip decompression without validating entry sizes, allowing an attacker to supply a malicious .docx file containing a zip bomb that decompr...

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.