The vulnerability allows an attacker to supply a malicious .docx file that contains a zip bomb. When Carbone processes the file with the yazl decompression library, it does not validate the size of each entry, so the uncompressed data can be orders of magnitude larger than the original. This excessive memory consumption can cause the application server to become unresponsive or crash, resulting in a denial of service. The weakness is an improper restriction of operations within bounds (CWE‑409).

Carbone, the open‑source document generation library. Versions older than 3.8.2, 4.26.3, or 5.4.4 are affected. The fix is included in those releases and later, and is available across all distribution types.

The CVSS score of 6.9 indicates moderate severity. The EPSS score is not available and the vulnerability is not listed in CISA KEV, so the current public exploit evidence is unknown. The likely attack vector is through any infrastructure component that accepts untrusted .docx uploads or API calls. An attacker could trigger the denial of service by sending a specially crafted zip bomb file, exhausting server memory and disrupting service availability. Due to the absence of input size checks, the attack does not require privileged access and can be remotely executed.