PatchSiren cyber security CVE debrief

CVE-2026-44017 docling-project CVE debrief

CVE-2026-44017 is a high-severity vulnerability in Docling, a document processing tool, that allows for arbitrary file writes and potential remote code execution. The vulnerability exists in the EasyOCR model download functionality prior to version 2.91.0, where ZIP archives are extracted without validating member paths, enabling Zip Slip attacks. If an attacker can compromise the model download source, they can write arbitrary files to any location writable by the process, potentially achieving remote code execution by overwriting Python files or system binaries, persistent backdoors by modifying startup scripts or SSH keys, and data corruption or system compromise. This vulnerability is fixed in version 2.91.0. The CVSS score for this vulnerability is 7.5, indicating a high severity.

Vendor: docling-project
Product: docling
CVSS: HIGH 7.5
CISA KEV: Not listed in stored evidence
Original CVE published: 2026-06-24
Original CVE updated: 2026-08-28
Advisory published: 2026-06-24
Advisory updated: 2026-08-28

Who should care

Organizations using Docling prior to version 2.91.0 should be aware of this vulnerability and take steps to mitigate it. This includes ensuring that the model download source is trusted and that the system is updated to version 2.91.0 or later. Additionally, defenders should monitor for potential exploitation attempts and implement compensating controls to prevent arbitrary file writes.

Technical summary

The vulnerability exists in the EasyOCR model download functionality of Docling, where ZIP archives are extracted without validating member paths. This allows for Zip Slip attacks, which can lead to arbitrary file writes and potential remote code execution. The vulnerability is fixed in version 2.91.0. The CVSS vector for this vulnerability is CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H, indicating a high severity.

Defensive priority

High priority should be given to updating Docling to version 2.91.0 or later. Defenders should also monitor for potential exploitation attempts and implement compensating controls to prevent arbitrary file writes.

Recommended defensive actions

Update Docling to version 2.91.0 or later
Monitor for potential exploitation attempts
Implement compensating controls to prevent arbitrary file writes
Verify the integrity of the model download source
Consider implementing additional security measures to prevent supply chain attacks

Evidence notes

The vulnerability is documented in the CVE record and the NVD detail page. The vendor has released a patch for the vulnerability in version 2.91.0. Red Hat has also provided additional information on the vulnerability, including a bugzilla entry and a CSAF VEX document.

Sources and references

Verified primary and authoritative sources

CVE-2026-44017 CVE Program record
Publisher, destination, and source semantics verified

URL: https://www.cve.org/CVERecord?id=CVE-2026-44017

CVE Program - Official CVE Program record with source-provided CVE metadata.
CVE-2026-44017 NVD vulnerability detail
Publisher, destination, and source semantics verified

URL: https://nvd.nist.gov/vuln/detail/CVE-2026-44017

NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

Mitigation or vendor reference
Unverified legacy reference

URL: https://github.com/docling-project/docling/releases/tag/v2.91.0

[email protected] - Product, Release Notes
Mitigation or vendor reference
Unverified legacy reference

URL: https://github.com/docling-project/docling/security/advisories/GHSA-cjqg-rq2h-2fvj

[email protected] - Mitigation, Patch, Vendor Advisory
Source reference
Unverified legacy reference

URL: https://access.redhat.com/security/cve/CVE-2026-44017

0b0ca135-0b70-47e7-9f44-1890c2a1c46c
Source reference
Unverified legacy reference

URL: https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-44017.json

0b0ca135-0b70-47e7-9f44-1890c2a1c46c

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.