Poland's national CERT has published a coordinated disclosure for CVE-2026-18929, a flaw in Carbone that lets one crafted document file crash the application server processing it. Every version before 3.8.2 is affected, and fixes are already out.
The mechanism is a zip bomb. A .docx file is a zip archive underneath, and a zip bomb is an archive built so that a tiny compressed file expands into an enormous one when it is unpacked, gigabytes out of kilobytes. Carbone decompresses .docx files using the yazl library without validating the size of the entries it is about to expand, so it unpacks whatever it is handed. The result, in CERT Polska's words, is excessive memory consumption and a crashed application server.
Denial of service, and nothing past it
It is worth being precise about the ceiling. The advisory describes a denial of service and stops there: no code execution, no data disclosure, and no report of anyone exploiting it. CERT Polska files it under CWE-409, improper handling of highly compressed data, and the practical consequence is a process falling over.
Whether that matters at all depends on what sits in front of the library. Where Carbone is doing document work behind a service that accepts files from outside, anyone who can supply a .docx can take it down, and keep taking it down for as long as they care to. Where it only ever sees templates the operator controls, the exposure is close to nothing. That gap is why a plain denial of service in a component nobody thinks about is still worth ten minutes of somebody's afternoon.
Fixed in 3.8.2, 4.26.3 and 5.4.4
The fix ships in three release lines, 3.8.2, 4.26.3 and 5.4.4, and CERT Polska says it is available across all distribution types, so there is no branch left stranded without one. The advisory offers no workaround, which makes upgrading the whole of the remediation.
The report reached CERT Polska through its coordinated vulnerability disclosure programme, and the team credits Mikolaj Dabek and Kamil Solecki for reporting it responsibly. The advisory carries the version table and the disclosure process behind it. This is the second Polish coordination note we have covered this month: the same programme handled a set of font parsing flaws in the Android build of Emacs a week ago. Neither is dramatic on its own. Both are the kind of small, unglamorous bug that only gets interesting once it turns out to be sitting inside something you did not know you were running.
This briefing is provided by IntelFusions for informational and defensive purposes only. It is based on sources assessed to be reliable at the time of writing, and analytic judgments carry the confidence levels indicated. Indicators of compromise are defanged; re-arm them only in controlled environments. IntelFusions is not affiliated with the organizations named and makes no warranty as to completeness or accuracy.