Docling CVE-2026-44018

Exploitation requires the victim application to process an attacker-supplied METS-GBS archive through Docling's METS-GBS backend (CVSS UI:R confirms required interaction - the malicious document must be ingested). No authentication is needed (PR:N), but the attack vector is local (AV:L): the attacker must get the crafted archive into a processing path rather than hitting a network listener directly. The XXE branch additionally depends on the parsing environment being able to resolve external entities (the pre-2.91.0 default), and the resource-exhaustion branch depends on the absence of extraction limits (also pre-2.91.0 default). Limiting factors: only the METS-GBS code path is affected, so deployments that never handle METS-GBS archives are not exposed, and impact is confined to file read and DoS (I:N - no data modification or code execution).

Signals are consistent and point to a real but moderate, non-urgent issue. The CVSS 3.1 vector (AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:H, base 7.1) describes a local-input, no-privilege, user-interaction-required flaw with high confidentiality and availability impact but no integrity impact - typical of a file-parsing vulnerability where the 'local' vector reflects that an application must ingest the malicious document. EPSS is essentially floor-level (0.01%, 3rd percentile) and the issue is not in CISA KEV, with no public exploit identified at time of analysis, so there is no evidence of opportunistic mass exploitation. No SSVC decision record was provided. The practical risk concentrates in deployments that feed untrusted documents into Docling (e.g., automated ingestion services or RAG pipelines): there, XXE-driven local file reads and DoS are credible. One nuance to verify: the vector lists AV:L, but if Docling is exposed via a network service that accepts uploaded archives, the effective exposure resembles remote-triggerable input even though scoring remains local - confirm against your deployment model rather than assuming console-only access.

An attacker submits a crafted METS-GBS archive to a service or workflow that uses Docling for document conversion. When Docling parses the embedded XML, an external entity reads a local file (e.g., credentials or config) and leaks it, or a nested zip/tar bomb expands without bounds to exhaust memory and disk and crash the application. No public exploit is identified at time of analysis, and success requires the target to actually process the malicious input (UI:R).