CVE-2026-126421
MEDIUM
NVD
CVSS Score
4.3
Severity
MEDIUM
Published
Nov 13, 2026
Vendor
unknown
Description
OpenEMR before 8.5.0 contains an uncontrolled resource consumption vulnerability that allows authenticated users with patients/med access to exhaust PHP workers via an unbounded count parameter. Attackers can send print_labels requests to labs_ajax.php with huge counts, forcing mPDF page and barcode generation that makes OpenEMR unavailable.