Junglewise Threat Intelligence

adawolfa isdoc decompression bomb in ISDOCX and PDF readers

Severity: medium · CVSS 6.5 · Published 2026-07-15

Executive brief

The adawolfa/isdoc library, used for processing electronic invoices in PHP applications, is vulnerable to resource exhaustion attacks. By providing a specially crafted ISDOCX or PDF file, an attacker can cause the application to consume massive amounts of memory or disk space. This can lead to a denial-of-service (DoS) condition, making the affected service unavailable to legitimate users.

Technical details

The adawolfa/isdoc library fails to validate the uncompressed size of ZIP entries in ISDOCX archives and embedded files within PDFs before processing them. An attacker can exploit this by providing a 'decompression bomb'—a small file that expands to gigabytes upon inflation—exhausting system memory or disk space. Specifically, the getFromName() and saveTo() functions lacked size caps or byte budgets during inflation and disk writes. The vulnerability is fixed in versions 1.4.3, 1.5.1, 1.6.1, and 2.0.0 by implementing size limits (256 KB for documents, 32 MB for supplements) and enforcing a running byte budget during file operations.

Affected products

  • adawolfa isdoc < 1.4.3, >= 1.5.0 < 1.5.1, >= 1.6.0 < 1.6.1

Timeline

  • 2026-06-05: patched: Fixes committed to master and backported branches.
  • 2026-07-15: advisory: GitHub Advisory GHSA-xg43-5579-qw6v published.

References