Pandora CVE-2026-74767
HIGHSeverity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-accessible unauthenticated file submission (AV:N, PR:N) with no complexity causes worker termination (A:H); scope unchanged, no confidentiality or integrity impact.
Primary rating from Vendor (5a6e4751-2f3f-4070-9419-94fb35b644e8).
CVSS VectorVendor: 5a6e4751-2f3f-4070-9419-94fb35b644e8
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Lifecycle Timeline
3DescriptionCVE.org
Pandora contains a denial-of-service vulnerability in its handling of DAA (Direct Access Archive) files. When extracting the internal ISO image from a DAA archive, compressed chunks were decompressed using zlib.decompress() without enforcing a limit on the resulting uncompressed data.
An attacker able to submit a crafted DAA file containing highly compressed data could cause Pandora to decompress a relatively small input into a very large amount of data in memory. Because the decompressed chunks are accumulated to construct the internal ISO image, this could result in excessive memory consumption and potentially CPU exhaustion, causing the extraction worker to become unresponsive, terminate, or affect the availability of the Pandora service.
The patch introduces bounded decompression using decompressobj().decompress() with max_extracted_filesize, verifies the cumulative size of decompressed chunks, and raises a dedicated ZipBomb exception when the configured limit is exceeded. Pandora then aborts extraction and reports the file as too large.
AnalysisAI
Unbounded zlib decompression in Pandora's DAA file extractor enables unauthenticated remote attackers to trigger memory and CPU exhaustion by submitting a crafted zip-bomb DAA archive. Because Pandora is a file analysis platform whose core function is accepting untrusted files, the attack surface is directly aligned with the product's intended use - no special access or configuration is required beyond file submission. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | No special conditions are required beyond the ability to submit a DAA file to a Pandora instance. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 4.0 base score of 8.7 with AV:N/AC:L/AT:N/PR:N/UI:N accurately reflects that no preconditions exist beyond submitting a file - exactly what Pandora is designed to receive. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker submits a maliciously crafted DAA archive - typically a few kilobytes or megabytes in compressed form - containing a highly compressed payload designed to expand to hundreds of gigabytes upon decompression. Pandora's extractor worker processes the file, calling unbounded zlib.decompress() on each chunk and accumulating the results in memory. … |
| Remediation | Apply the upstream patch by updating Pandora to a version that incorporates commit f4294a873f86fbf2569c289e329fff2f52ca50c9 (https://github.com/pandora-analysis/pandora/commit/f4294a873f86fbf2569c289e329fff2f52ca50c9). … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, disable DAA file uploads on Pandora and implement request rate limiting on the extraction service to prevent abuse; confirm the current Pandora version and affected systems. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Same technique File Upload
View allShare
External POC / Exploit Code
Leaving vuln.today