A specially crafted HTML document containing an extremely large image can cause the Dompdf engine to consume excessive CPU time and memory during rendering. The flaw lies in early dimension checks that are bypassed by high‑entropy, Base64‑encoded images wrapped in CSS, allowing the internal buffers to grow without proper limits. When these resources are exhausted, the PHP process crashes, resulting in a denial of service for the web server hosting the application.

Applications built with the Dompdf library, any version 3.15 or earlier, are vulnerable. This includes web sites or services that accept user‑supplied HTML or URLs and convert them to PDF. All installations of dompdf:dompdf before 3.16 are affected.

The CVSS score of 6.3 indicates a moderate severity, and the EPSS score of less than 1% shows a very low current likelihood of exploitation. The vulnerability is not listed in the CISA KEV catalog, and no public exploits have been reported. An unauthenticated remote attacker could exploit the flaw by submitting a malicious HTML payload to any exposed endpoint that feeds data to Dompdf. Because the flaw is triggered only during rendering, an attacker needs access to an interface that triggers PDF generation.