Docling-core, a document processing library, in versions 2.5.0 through 2.74.0, permits local file:// URI image references and inline data: content without enforcing a decoded size limit. This external control of file name or path (CWE-73) can allow an attacker supplying untrusted image references to access local files readable by the application process or cause excessive memory use (CWE-400) due to large inline payloads. The vulnerability is addressed in version 2.74.1.

An attacker who can supply untrusted image references to docling-core may exploit this vulnerability to read local files accessible by the process, potentially exposing sensitive information. Additionally, the lack of a decoded-size limit on inline data: content can cause excessive memory consumption, leading to denial of service conditions. The CVSS 3.1 score is 8.1 (high), reflecting network attack vector, low attack complexity, no privileges required, user interaction required, unchanged scope, high confidentiality impact, no integrity impact, and high availability impact.

A fix is available in docling-core version 2.74.1. Users should upgrade to version 2.74.1 or later to remediate this vulnerability. Until upgraded, applications should avoid accepting untrusted image references or implement strict validation and size limits on inline data content.