The adawolfa/isdoc library reads ISDOC invoices from ISDOCX ZIP archives and PDF files with embedded ISDOC documents. Vulnerable versions inflate ZIP entries and read embedded files without validating their uncompressed size, enabling decompression bombs that can consume excessive memory or disk space. Specifically, getFromName() inflates ISDOC documents and supplements without size caps, saveTo() writes inflated data to disk without byte limits, and PDF embedded files with large declared lengths are processed without upper bounds. Exploitation requires processing attacker-supplied .isdocx or .pdf files, leading to denial of service by exhausting system resources. Fixed in versions 1.4.3, 1.5.1, 1.6.1, and 2.0.0 by enforcing size limits on decompressed data and rejecting oversized entries before inflation or reading.

Exploitation results in denial of service through exhaustion of memory or disk space when processing maliciously crafted ISDOCX or PDF files. There is no confidentiality or integrity impact. The vulnerability can cause application or system unavailability due to uncontrolled resource consumption during decompression and file reading.

Fixed versions 1.4.3, 1.5.1, 1.6.1, and 2.0.0 enforce size limits on decompressed ZIP entries and embedded PDF files, rejecting oversized entries before processing. Users should upgrade to one of these versions. No code-level workaround exists in affected versions. As a mitigation, restrict parsing to trusted inputs or externally enforce size and decompression limits before passing files to the library.