Full Report
Improper handling of highly compressed data (data amplification) vulnerability (CVE-2026-18929) has been found in Carbone software.
Analysis Summary
# Vulnerability: Zip Bomb DoS in Carbone Software
## CVE Details
- **CVE ID:** CVE-2026-18929
- **CVSS Score:** Not explicitly listed in report (Estimated: High/7.5 based on Availability impact)
- **CWE:** CWE-409: Improper Handling of Highly Compressed Data (Data Amplification)
## Affected Systems
- **Products:** Carbone (Reporting engine/library)
- **Versions:**
- All versions prior to **3.8.2**
- All versions prior to **4.26.3**
- All versions prior to **5.4.4**
- **Configurations:** Systems processing user-supplied `.docx` files.
## Vulnerability Description
Carbone is vulnerable to a Denial of Service (DoS) via "zip bomb" attacks. The software utilizes the `yazl` library for decompressing `.docx` files (which are XML-based ZIP archives) without implementing validation for the size of individual entries.
An attacker can craft a malicious `.docx` file containing highly compressed data. When Carbone attempts to process this file, the data amplifies significantly upon decompression, leading to exhaustion of system memory (RAM) and causing the application server to crash.
## Exploitation
- **Status:** PoC availability not explicitly stated, but the nature of the flaw is well-understood (standard zip bomb).
- **Complexity:** Low
- **Attack Vector:** Network (Remote submission of a malicious document)
## Impact
- **Confidentiality:** None
- **Integrity:** None
- **Availability:** High (Application crash/service unavailability)
## Remediation
### Patches
The vendor has released security updates across all distribution types. Users should upgrade to one of the following versions depending on their current release branch:
- **v3.8.2**
- **v4.26.3**
- **v5.4.4**
### Workarounds
- **Input Validation:** Implement strict file size limits on uploaded `.docx` files at the application gateway level.
- **Resource Monitoring:** Deploy aggressive memory limits (OOM killer triggers) and auto-restart policies for the Carbone service container/process.
## Detection
- **Indicators of Compromise:** Unusual spikes in RAM consumption immediately following the upload or processing of a specific `.docx` file.
- **Detection Methods:** Monitor application logs for errors originating from the `yazl` decompression library or system logs indicating "Out of Memory" (OOM) events.
## References
- **Vendor Advisory:** hxxps[://]cert[.]pl/en/posts/2026/08/CVE-2026-18929/
- **CVE Record:** hxxps[://]www[.]cve[.]org/CVERecord?id=CVE-2026-18929
- **CWE-409 Definition:** hxxps[://]cwe[.]mitre[.]org/data/definitions/409[.]html