CVE-2026-59941

Received Received - Intake

Dompdf Memory Amplification via Malicious BMP Image

Publication date: 2026-07-28

Last updated on: 2026-07-28

Assigner: GitHub, Inc.

Description

Dompdf is an HTML to PDF converter for PHP. Versions 3.15 and prior accept a BMP image and generates a PDF-compatible PNG based only on its declared header dimensions and never bounds width × height before the image is converted through GD. A 58-byte BMP whose header declares e.g. 6000×6000 is accepted and later drives imagecreatetruecolor($width, $height) (and PHP's native BMP decoder) to allocate the full pixel canvas. A payload can fit in a single HTTP request: the BMP can be inlined as a data:image/bmp;base64,… URI inside attacker-controlled HTML, so no upload, no remote fetch, and no chroot-reachable file is required. I measured a 169-byte request driving a dompdf render to ~412 MB peak RSS and ~4.8 s of CPU/wall time, versus ~34 MB for an identically-sized benign request — roughly a 12× memory amplification per request, repeatable and unauthenticated. This issue has been fixed in version 3.16.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-07-28

Last Modified

2026-07-28

Generated

2026-07-29

AI Q&A

2026-07-29

EPSS Evaluated

N/A

NVD

CVE-2026-59941

Affected Vendors & Products

Vendor	Product	Version / Range
dompdf	dompdf	to 3.16 (exc)
dompdf	dompdf	3.16

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-400	The product does not properly control the allocation and maintenance of a limited resource.

Attack-Flow Graph

Executive Summary

Dompdf is a PHP library that converts HTML to PDF. This vulnerability allows attackers to craft a malicious BMP image that tricks Dompdf into allocating excessive memory during PDF generation. The issue occurs because Dompdf processes BMP headers without validating the actual image dimensions, leading to a memory amplification attack.

Detection Guidance

Detecting this vulnerability requires checking if your system uses a vulnerable version of Dompdf (3.15 or prior). Inspect installed PHP packages for dompdf versions <=3.15. Monitor for unusual memory or CPU spikes during PDF generation, especially with BMP images in requests.

Impact Analysis

An attacker could send a specially crafted HTTP request containing a tiny BMP image (169 bytes) that causes Dompdf to consume up to 412 MB of memory and take 4.8 seconds to process. This can lead to denial-of-service conditions, slow down servers, or crash applications relying on Dompdf for PDF generation.

Compliance Impact

This vulnerability could lead to denial-of-service conditions due to excessive memory consumption, potentially disrupting services handling sensitive data. For GDPR, it may impact availability of systems processing personal data. For HIPAA, it could affect the integrity and availability of systems handling protected health information.

Mitigation Strategies

Upgrade Dompdf to version 3.16 or later immediately. If upgrading is not possible, disable BMP image processing in Dompdf or restrict image uploads to trusted sources. Monitor system resources for abnormal usage patterns.

Hi! I’m here to help you understand CVE-2026-59941. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70