CVE-2026-55555: Dompdf vulnerability (CVSS 7.5)

Description

Dompdf is an HTML to PDF converter for PHP. Versions 3.15 and prior are vulnerable to a File Existence Oracle attack through the manipulation of the CSS @font-face directive. By providing malicious HTML that references local files via the file:// protocol repeatedly, an attacker can trigger PHP memory exhaustion. Because Dompdf behaves differently depending on whether a referenced local file exists (an existing file is processed repeatedly until it triggers an "Allowed memory size exhausted" crash, whereas a missing file fails fast or is ignored and never hits the memory limit), an attacker can use this observable discrepancy as an oracle to enumerate sensitive files on the server regardless of CHROOT restrictions. Exploitation requires the attacker to supply unrestricted or unsanitized HTML in a request that permits large data, plus a configuration where Dompdf's memory limit is low enough to be exhausted (with $_dompdf_show_warnings=true making the overflow easier to reach). This issue has been fixed in version 3.16.

CVSS 3.1 breakdown

Attack vectorNetwork

Attack complexityLow

Privileges requiredNone

User interactionNone

ScopeUnchanged

ConfidentialityHigh

IntegrityNone

AvailabilityNone

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Affected products

Dompdf< 3.16

Remediation

Fixed in

Dompdf≥ 3.16

Patch & vendor advisories

References

https://github.com/dompdf/dompdf/commit/75c39a083bf7298044fb27399b4cc183054438b4Patch
https://github.com/dompdf/dompdf/releases/tag/v3.1.6Release Notes
https://github.com/dompdf/dompdf/security/advisories/GHSA-7x2p-4jvh-6384ExploitVendor Advisory

Related CVEs

Recent high-severity vulnerabilities sharing a weakness type.

Frequently asked

Is CVE-2026-55555 being actively exploited?

CVE-2026-55555 is not in the CISA KEV catalog. A public exploit reference exists, so treat it as exploitable. Its EPSS exploit probability is 0.51%.

How severe is CVE-2026-55555?

CVE-2026-55555 has a CVSS 3.1 base score of 7.5, rated high. EPSS estimates a 0.51% probability of exploitation.

Which products are affected by CVE-2026-55555?

Affected products include Dompdf.

How do I fix CVE-2026-55555?

Upgrade affected software to a fixed version, for example Dompdf 3.16 or later, then confirm no affected versions remain in your inventory.

How Secuno handles this

Secuno correlates vulnerabilities like CVE-2026-55555 against the real software inventory on every managed device, as each hourly inventory arrives. Rather than a static severity, each match is scored in context: exploit availability, EPSS, the asset's exposure, and business criticality decide where it lands in the queue. If an affected version is present anywhere across your portfolio, it surfaces automatically with a prioritised remediation path.

See how prioritisation works Book a demo