BabelDOC prior to 0.7.0 can be forced to run an extreme number of loop iterations when parsing a ToUnicode CMap that contains unbounded bfrange and cidrange entries. The parser exhausts CPU cycles and memory, causing the translation worker to stall and the process to become unresponsive. The primary consequence is a denial of service that can affect the availability of the application or the system hosting it.

The vulnerability affects all releases of BabelDOC from version 0.3.61 up through any build before 0.7.0, including all 0.6.x iterations shipped by the funstory-ai team.

The CVSS score of 8.7 indicates a high severity level, and the EPSS is not available. The vulnerability is not currently listed in CISA KEV, but its exploitation can be achieved remotely by delivering a crafted PDF to a running instance of BabelDOC. An attacker does not need privileged access; merely providing the special PDF will consume excessive resources. Because the attack vector is remote and the exploitation is straightforward, the risk of impact remains high, especially in production environments.