2496 matches found
CVE-2026-59941
Dompdf is an HTML to PDF converter for PHP. Versions 3.15 and prior accept a BMP image and generates a PDF-compatible PNG based only on its declared header dimensions and never bounds width × height before the image is converted through GD. A 58-byte BMP whose header declares e.g. 6000×6000 is...
CVE-2026-59941 Dompdf: Uncontrolled resource consumption based on declared BMP dimensions
Dompdf is an HTML to PDF converter for PHP. Versions 3.15 and prior accept a BMP image and generates a PDF-compatible PNG based only on its declared header dimensions and never bounds width × height before the image is converted through GD. A 58-byte BMP whose header declares e.g. 6000×6000 is...
CVE-2026-59941 Dompdf: Uncontrolled resource consumption based on declared BMP dimensions
Dompdf is an HTML to PDF converter for PHP. Versions 3.15 and prior accept a BMP image and generates a PDF-compatible PNG based only on its declared header dimensions and never bounds width × height before the image is converted through GD. A 58-byte BMP whose header declares e.g. 6000×6000 is...
Uncontrolled Resource Consumption
dompdf/dompdf is vulnerable to Uncontrolled Resource Consumption. The vulnerability is due to the library trusting attacker-controlled BMP header dimensions without validating the image size before conversion, which allows an attacker to embed a crafted BMP image e.g., via a data:image/bmp;base64...
Dompdf: Uncontrolled resource consumption based on declared BMP dimensions
Summary dompdf accepts a BMP image and generates a PDF-compatible PNG based only on its declared header dimensions and never bounds width × height before the image is converted through GD. A 58-byte BMP whose header declares e.g. 6000×6000 is accepted and later drives imagecreatetruecolor$width,...
Denial of Service (DoS)
Overview Affected versions of this package are vulnerable to Denial of Service DoS via the imagecreatefrombmp process. An attacker can cause excessive memory and CPU consumption by submitting a specially crafted BMP image with large declared dimensions embedded as a data URI in HTML. This can lea...
PT-2026-63553
Name of the Vulnerable Software and Affected Versions Dompdf versions prior to 3.16 Description Dompdf fails to validate the dimensions of BMP images before processing them. The software relies solely on the declared header dimensions to allocate memory for the image canvas via the...
EUVD-2026-42580
A vulnerability has been found in GNU LibreDWG up to 0.13.4. The affected element is the function dwgbmp of the file src/dwg.c of the component BMP Image Handler. Such manipulation leads to heap-based buffer overflow. The attack must be carried out locally. The exploit has been disclosed to the...
CVE-2026-15182
GNU LibreDWG prior to 0.14 is affected by a heap-based overflow in the BMP Image Handler (dwg_bmp in src/dwg.c). Local exploitation is possible; the vulnerability can be triggered through the BMP image handling pathway, with an exploit disclosed publicly. Upgrading to version 0.14 resolves the is...
CVE-2026-15182 GNU LibreDWG BMP Image dwg.c dwg_bmp heap-based overflow
A vulnerability has been found in GNU LibreDWG up to 0.13.4. The affected element is the function dwgbmp of the file src/dwg.c of the component BMP Image Handler. Such manipulation leads to heap-based buffer overflow. The attack must be carried out locally. The exploit has been disclosed to the...
PYSEC-2026-716 Improper Restriction of Operations within the Bounds of a Memory Buffer in OpenCV
OpenCV Open Source Computer Vision Library through 3.3 corresponding to OpenCV-Python 3.3.0.9 has a buffer overflow in the cv::BmpDecoder::readData function in modules/imgcodecs/src/grfmtbmp.cpp when reading an image file by using cv::imread, as demonstrated by the 4-buf-overflow-readData-memcpy...
RLSA-2023:2589 Moderate: autotrace security update
AutoTrace is a program for converting bitmaps to vector graphics. Security Fixes: autotrace: heap-buffer overflow via the ReadImage at input-bmp.c CVE-2022-32323 For more details about the security issues, including the impact, a CVSS score, acknowledgments, and other related information, refer t...
autotrace security update
An update is available for autotrace. This update affects Rocky Linux 8. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list AutoTrace is a program for converting bitmaps to vector graphics. Security...
Astra Linux – Vulnerability in freerdp3
FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to version 3.24.0, the gdisurfacebits function processed SURFACEBITSCOMMAND messages sent by the RDP server. When these commands were processed using NSCodec, the bmp.width and bmp.height values provided by the server were not...
Linux Distros Unpatched Vulnerability : CVE-2026-42500
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Decoding a paletted BMP file with an out-of-range palette index results in a panic when accessing pixels in the invalid image. CVE-2026-42500 Note that Nessus...
Out-of-bounds Read
Overview Affected versions of this package are vulnerable to Out-of-bounds Read in the Decoding process of BMP files containing a palette with out-of-range indices. An attacker can cause a panic and potentially disrupt application availability by supplying a crafted BMP file with invalid palette...
Out-of-bounds Read
Overview Affected versions of this package are vulnerable to Out-of-bounds Read in the Decoding process of BMP files containing a palette with out-of-range indices. An attacker can cause a panic and potentially disrupt application availability by supplying a crafted BMP file with invalid palette...
DEBIAN-CVE-2026-42500
Decoding a paletted BMP file with an out-of-range palette index results in a panic when accessing pixels in the invalid image...
