CVE-2026-59941

Name of the Vulnerable Software and Affected Versions Dompdf versions prior to 3.16

Description Dompdf fails to validate the dimensions of BMP images before processing them. The software relies solely on the declared header dimensions to allocate memory for the image canvas via the imagecreatetruecolor() function or the native imagecreatefrombmp() function, without verifying if the actual image data matches these dimensions. An attacker can provide a small BMP file with excessively large declared dimensions (e.g., 6000x6000) inlined as a data:image/bmp;base64 URI within attacker-controlled HTML. This leads to significant memory amplification and CPU consumption, as the allocation occurs in the GD library's native memory, bypassing PHP's memory limit configuration. This can be exploited by unauthenticated users to exhaust server resources and cause a denial of service.

Recommendations Update Dompdf to version 3.16.