---
id: "CVE-2026-126423"
page: "https://infrastack.ai/live/CVE-2026-126423"
kind: "vulnerability"
aliases: ["CVE-2026-126423"]
title: "OpenEMR: crafted ZIP uploads exhaust memory and make the app unavailable"
severity: "medium"
cvss: 5.3
epss: null
exploited: false
status: "open"
category: "runtime"
products: []
ecosystems: []
tags: ["healthcare", "openemr", "php", "runtime", "self-hosted"]
not_affected_if: ["no-billing-or-carecoordination-users", "openemr-8.5.0-or-later"]
published_at: "2026-11-13T10:17:48+00:00"
first_seen_at: "2026-11-13T10:47:21+00:00"
updated_at: "2026-11-13T10:57:17+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-126423", "first_seen_at": "2026-11-13T10:47:21+00:00"}]
exploit_sources: []
---

# OpenEMR: crafted ZIP uploads exhaust memory and make the app unavailable

Link for people: https://infrastack.ai/live/CVE-2026-126423 (this .md is for agents)

OpenEMR before 8.5.0 reads uncompressed ZIP entries into memory in four upload paths without size or ratio checks. An authenticated billing or care-coordination user can upload a highly compressed archive to exhaust PHP memory and worker pools, making the system unavailable.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the OpenEMR version in the installed application; versions below `8.5.0` are in scope.
- Confirm whether billing or Carecoordination users can upload files to the ZIP upload paths.

## Fix

- OpenEMR `8.5.0` or later, per the advisory.

## Timeline

- 2026-11-13T10:47:21+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-126423

## Documents

- [advisory] Vendor advisory: github.com https://github.com/openemr/openemr/security/advisories/GHSA-pqmf-m4h6-wjh4
- [advisory] Third-party advisory: www.vulncheck.com https://www.vulncheck.com/advisories/openemr-before-8.5.0-denial-of-service-via-zip-upload-decompression

## From the sources

OpenEMR before 8.5.0 contains a denial of service vulnerability in four ZIP upload paths that read uncompressed entries into memory without size or ratio checks. Authenticated billing or Carecoordination users can upload highly compressed ZIP archives to exhaust PHP memory and worker pools, making OpenEMR unavailable.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_