CVE-2026-59941

Dompdf (PHP HTML-to-PDF library) versions 3.15 and earlier are vulnerable to uncontrolled resource consumption when processing BMP images. The bug trusts declared BMP header dimensions (width × height) without bounding the pixel data, allowing an attacker to inline a crafted BMP via data URI (e.g...