Improper Handling of Highly Compressed Data (Data Amplification) Affecting adawolfa/isdoc package, versions <1.4.3>=1.5.0, <1.5.1>=1.6.0, <1.6.1
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications- Snyk IDSNYK-PHP-ADAWOLFAISDOC-17987661
- published16 Jul 2026
- disclosed15 Jul 2026
- creditUnknown
Introduced: 15 Jul 2026
New CVE NOT AVAILABLE CWE-409 (opens in a new tab)How to fix?
Upgrade adawolfa/isdoc to version 1.4.3, 1.5.1, 1.6.1 or higher.
Overview
Affected versions of this package are vulnerable to Improper Handling of Highly Compressed Data (Data Amplification) through the processing of untrusted .isdocx or .pdf files, where ZIP entries and embedded files are inflated or read without validating their uncompressed size. An attacker can exhaust system memory or disk resources by supplying a specially crafted compressed file that expands to a very large size when processed. This is only exploitable if a user or application is induced to parse a malicious file.
Workaround
This vulnerability can be mitigated by restricting parsing to trusted input or enforcing an external size or decompression limit (such as validating ZIP entry sizes or capping process memory) before handing files to the library.