Loading story…
CERT Polska disclosed CVE-2026-18929, a denial-of-service vulnerability in Carbone that allows a specially crafted .docx file to exhaust server memory and crash the application. The issue stems from improper handling of highly compressed data during ZIP processing: Carbone uses yazl for decompression without validating archive entry sizes, enabling a malicious document to expand massively in memory when processed.
The flaw affects all Carbone versions before 3.8.2 and has been fixed in versions 3.8.2, 4.26.3, and 5.4.4. The weakness aligns with CWE-409 Improper Handling of Highly Compressed Data (Data Amplification), commonly associated with zip-bomb style attacks. CERT Polska coordinated disclosure, and Mikołaj Dąbek and Kamil Solecki were credited with responsibly reporting the vulnerability.
See affected versions and whether adversaries are exploiting it.
2 events from the most recent confirmed update back to the earliest known activity.
On 18 August 2026, CVE-2026-18929 was published for a Carbone denial-of-service vulnerability involving malicious .docx zip bombs that can trigger excessive memory consumption and crash the application server. CERT Polska says it received the report and coordinated disclosure, and credits Mikołaj Dąbek and Kamil Solecki with responsibly reporting the issue.
Carbone released fixes for a denial-of-service vulnerability caused by improper handling of highly compressed data in .docx files. The issue affects all versions before 3.8.2, and the vendor states it was fixed in versions 3.8.2, 4.26.3, and 5.4.4 across all distribution types.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
CERT Polska disclosed **CVE-2026-18929**, a denial-of-service vulnerability in Carbone caused by improper handling of highly compressed data inside `.docx` files. The flaw lets a malicious document act as a ZIP bomb, expanding massively in memory and crashing the application server. The issue was described as a data amplification problem tied to Carbone's processing of compressed content. The vulnerability affects all Carbone versions before **3.8.2** and stems from the software's use of **yazl** for ZIP decompression without validating entry sizes. Fixes were released in versions **3.8.2**, **4.26.3**, and **5.4.4**. CERT Polska coordinated disclosure of the issue, and researchers **Mikołaj Dąbek** and **Kamil Solecki** were credited with responsibly reporting the bug.
Aug 18, 2026
Researchers disclosed **CVE-2026-48095**, a critical heap buffer overflow in 7-Zip affecting version `26.00` and earlier that can lead to application crashes, denial of service, or arbitrary code execution. The bug, reported by Jaroslav Lobačevski of GitHub Security Lab and tracked in advisory `GHSL-2026-140`, resides in the NTFS archive handler’s `CInStream::GetCuSize()` logic, where an under-allocation can shrink a buffer to 1 byte before a later operation writes up to 256 MB of attacker-controlled data into it. The resulting heap corruption can overwrite adjacent objects, including a stream object’s **vtable** pointer, creating a path to code execution. The vulnerability can be triggered simply by opening a specially crafted file because 7-Zip uses signature-based fallback detection and may route files disguised as `.7z`, `.zip`, or `.rar` into the vulnerable NTFS parser regardless of extension. Reports say both 32-bit and 64-bit builds are affected, with 64-bit systems that have sufficient memory more likely to reach reliable code execution, while lower-memory systems may instead crash. Public disclosure included technical details and a Python proof-of-concept generator, raising the risk of weaponization; the issue carries a **CVSS 3.1 score of 8.8**, and users are being urged to update 7-Zip and avoid opening untrusted archives.
Jun 29, 2026
A newly disclosed **7-Zip** vulnerability, tracked as `CVE-2026-14266`, allows remote code execution via a heap-based buffer overflow in the handling of crafted **XZ chunked data**. An attacker can trigger the flaw if a user opens a malicious archive or is lured to content that delivers a specially crafted XZ payload, causing code to run with the privileges of the current user. The issue is considered significant because 7-Zip is widely deployed and the attack path can be readily paired with phishing or malicious attachments. The bug was reported by Landon Peng of Lunbun LLC through coordinated disclosure, and the Zero Day Initiative published advisory **`ZDI-26-444`** after the fix became available. **7-Zip version 26.02**, released on June 25, 2026, contains the patch, and reporting said no public proof-of-concept or in-the-wild exploitation had been confirmed at publication. The flaw was assigned a **CVSS 7.0** score, reflecting the need for user interaction and a relatively complex exploit path, and users were urged to update and avoid opening untrusted compressed files.
Jul 24, 2026