NLTK CVE-2026-81723

Exploitation requires the ability to supply a malformed XML corpus file to an application that passes attacker-controlled input to NLTK's XMLCorpusView or a derived reader such as BNCCorpusReader. The application must not sanitize, size-limit, or validate corpus files before forwarding them to NLTK. The CVSS 4.0 AT:P metric confirms a specific precondition: the deployment must accept untrusted XML corpus input rather than operating only over internal, pre-validated datasets. Standard offline NLTK usage - a data scientist loading their own corpora in a Jupyter notebook or a batch pipeline consuming trusted files - is not exploitable. Exploitation is further limited by AC:H: the attacker must craft a file that specifically triggers the quadratic rescan pattern, and must have a pathway (network upload, API call, or shared file system access) to deliver that file to the processing application.

The CVSS 4.0 vector (AV:N/AC:H/AT:P/PR:N/UI:N/VA:L) yields a score of 6.3. The AT:P metric explicitly signals that specific attack prerequisites must be present - the application must accept and forward attacker-controlled XML corpus data to NLTK readers. Real-world risk is meaningfully lower than the surface CVSS score implies: NLTK is predominantly used in offline NLP pipelines, Jupyter notebooks, and research tooling rather than as internet-facing infrastructure. Applications that do accept external corpus uploads or user-defined file paths to XML readers represent the realistic attack surface. No EPSS score was provided in the intelligence feed, so quantified exploitation probability is unavailable. The official VA:L rating may understate CPU impact for large malformed inputs given the description explicitly characterizes the exhaustion as 'severe' - defenders should treat availability impact as closer to high in contexts where the application processes large or unbounded XML corpus files from untrusted sources. No KEV listing and no identified POC code further reduce immediate urgency for most deployments.

An attacker with access to a web API or file-upload endpoint that feeds user-provided corpora into an NLTK-based NLP pipeline submits a specially crafted malformed XML file targeting the XMLCorpusView reader. As the application processes the file in 1 KiB blocks, CPU consumption grows quadratically, progressively starving other processes on the host and degrading or halting service availability for legitimate users. No POC code has been identified, but the algorithmic nature of the flaw means any developer familiar with NLTK internals could reproduce it from the public description.