CVE-2026-55555
Description
Dompdf is vulnerable to a File Existence Oracle attack through the manipulation of the CSS @font-face directive. By providing malicious HTML that references local files via the file:// protocol repeatedly, an attacker can trigger PHP memory exhaustion.
The critical point of this flaw is the discrepancy in system behavior:
1. If the file exists: Dompdf attempts to process the local resource multiple times, leading to an "Allowed memory size exhausted" error, which crashes the creation.
2. If the file does NOT exist: The rendering engine fails quickly or ignores the import, and the memory limit is not reached.
This discrepancy allows an attacker to enumerate sensitive files on the server, regardless of CHROOT restrictions.
Some factors impact the ability of attackers to exploit the vulnerability:
- The attacker must be allowed to provide unrestricted and/or unsanitized HTML content.
- System parameters must be configured in such a way that Dompdf is able to generate a memory overflow error.
- HTTP GET querystring or POST body must allow large data
- Memory limits must be low enough that Dompdf can trigger an overflow
- $_dompdf_show_warnings when set to true can bump memory usage
Example Scenario
1. Vulnerable System
A web application provides a public mechanism for generating a PDF based on user supplied content. The application accepts raw HTML input or renders user-supplied content without sanitation or validation and processes it using Dompdf.
- Vulnerable Endpoint: http://example.com/index.php
- Vulnerable Parameter: html_input (POST)
index.php simplified:
$dompdf = new Dompdf(new Options());
$dompdf->loadHtml($_POST['html_input']);
$dompdf->render();
$dompdf->stream("document.pdf");
<img width="2530" height="1320" alt="image" src="https://github.com/user-attachments/assets/a3fe336c-097a-408a-b8b4-cdbaf5f8d7c4" />
2. Attack Generation
The attacker runs a script locally on their own machine to generate a heavy payload. This payload is the
⚡ Watch CVE-2026-55555
Get an email if CVE-2026-55555 is added to CISA KEV, gains public exploit code, or a new advisory cites it — max one per day, one-click unsubscribe.
Exploitation outlook
- Low exploitation risk0.50% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 40% of all EPSS-scored CVEs.
Advisory coverage (2)
External references
Embed the live status
— this badge updates automatically when the KEV or exploit status changes. How to embed it →
[](https://www.csirts.com/cve/CVE-2026-55555)