Docling Core, a core library for the Docling document processing framework, has insufficient validation of image reference URIs. Versions 2.5.0 through 2.74.0 allow image references that use the local file:// scheme and accept inline data with no decoded-size limit. In applications that process untrusted image URLs, this flaw can provide a path to read any file that the process can access, as well as allow excessively large inline payloads to consume memory. The result is a confidentiality breach when local files are read and a potential denial of service via memory exhaustion. This weakness corresponds to CWE‑400 (Uncontrolled Resource Consumption) and CWE‑73 (Relative Path Traversal).

The vulnerability affects Docling Core versions 2.5.0 through 2.74.0, used in the Docling document processing framework. All installations running these affected versions are potentially impacted, regardless of the specific deployment environment or configuration, because the flaw operates at the core library level.

The CVSS score is 8.1, indicating high severity, but the EPSS score is below 1%, and the vulnerability is not listed in CISA's KEV catalog. Attackers would need to supply crafted image references to the application; in contexts where input is from untrusted users, local file read and memory exhaustion are feasible attack outcomes.