# CVE-2026-44018

## Summary

- **CVE ID:** CVE-2026-44018
- **Severity:** MEDIUM
- **CVSS Score:** 5.5 (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H)
- **CWE:** CWE-409, CWE-611, CWE-776
- **Published:** Jun 26, 2026
- **Last Modified:** Jun 26, 2026

## Description

Docling simplifies document processing by parsing diverse formats and providing integrations with the generative AI ecosystem. From 2.45.0 until 2.91.0, the METS-GBS backend's XML parsing and the input document format detection lacked security controls. An attacker could craft malicious METS-GBS archives that, when processed, could read sensitive files, exhaust system resources, or cause application crashes. This vulnerability is fixed in 2.91.0.

## Affected Products

- docling-project — docling (>= 2.45.0, < 2.91.0)

## References

- [CNA](https://github.com/docling-project/docling/security/advisories/GHSA-r3xg-rg9j-67fv)
- [CNA](https://github.com/docling-project/docling/releases/tag/v2.91.0)

## Exploitation Prediction (EPSS)

- **EPSS Score:** 0.16%
- **EPSS Percentile:** 5.6

---
_Exported from OnDuty AI Vulnerability Intelligence on 2026-09-11._