CVE-2026-59941: Dompdf is an HTML to PDF converter for PHP. Versions 3.15 and prior accept a BMP image and generates a PDF-compatible PNG based only on its declared header dimensions and never bou

unknownCVE-2026-59941

Dompdf is an HTML to PDF converter for PHP. Versions 3.15 and prior accept a BMP image and generates a PDF-compatible PNG based only on its declared header dimensions and never bounds width × height before the image is converted through GD. A 58-byte BMP whose header declares e.g. 6000×6000 is accepted and later drives imagecreatetruecolor($width, $height) (and PHP's native BMP decoder) to allocate the full pixel canvas. A payload can fit in a single HTTP request: the BMP can be inlined as a data:image/bmp;base64,… URI inside attacker-controlled HTML, so no upload, no remote fetch, and no chroot-reachable file is required. I measured a 169-byte request driving a dompdf render to ~412 MB peak RSS and ~4.8 s of CPU/wall time, versus ~34 MB for an identically-sized benign request — roughly a 12× memory amplification per request, repeatable and unauthenticated. This issue has been fixed in version 3.16.

Details

Source: NVD Recent CVEs (US · database · site)
Severity: unknown
Published: 2026-07-28
Last updated: 2026-07-30
Exploitation: Not in CISA KEV at last sync

Original advisory: https://nvd.nist.gov/vuln/detail/CVE-2026-59941

Exploitation outlook

EPSS (FIRST.org) estimates each CVE’s probability of exploitation in the next 30 days — here is the CSIRTS.com read on those numbers.

Low exploitation riskCVE-2026-599410.51% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 41% of all scored CVEs.

Referenced CVEs

CVE	CSIRTS overview	External
CVE-2026-59941	coverage & exploitation status	NVD · CVE.org

Same CVEs, other sources

How other CERTs, PSIRTs and databases cover the vulnerabilities in this advisory.

mediumGHSA-8hg6-c449-896m: Dompdf: Uncontrolled resource consumption based on declared BMP dimensionsghsa

Recent advisories for Dompdf is an

A cluster of recent advisories against the same product widens the attack surface — attackers routinely chain freshly published CVEs on one product, so review these together.

unknownCVE-2026-59943: Dompdf is an HTML to PDF converter for PHP. In versions 3.15 and prior, if a malicious actor c…nvd · 2026-07-28
unknownCVE-2026-59942: Dompdf is an HTML to PDF converter for PHP. Versions 3.15 and prior are vulnerable to a Denial…nvd · 2026-07-28
unknownCVE-2026-56722: Dompdf is an HTML to PDF converter for PHP. In versions 3.15 and prior, aAn attacker who contr…nvd · 2026-07-28
unknownCVE-2026-55555: Dompdf is an HTML to PDF converter for PHP. Versions 3.15 and prior are vulnerable to a File E…nvd · 2026-07-28
unknownCVE-2026-55554: Dompdf is an HTML to PDF converter for PHP. In versions 3.15 and prior, the validateLocalUri()…nvd · 2026-07-28
mediumGHSA-j8qw-6jw8-r297: Dompdf: Embedded SVG images can leak existence of files and directories within the filesy…ghsa · 2026-07-22