Dompdf before version 3.1.6 is susceptible to a file existence oracle attack through manipulation of the CSS @font-face directive referencing local files via file:// URLs. When processing malicious HTML input, Dompdf attempts to load local files repeatedly. If the file exists, Dompdf exhausts PHP memory limits and crashes; if not, it fails quickly without exhausting memory. This discrepancy allows attackers to enumerate sensitive files on the server by submitting crafted HTML payloads and analyzing the PDF generation outcome. Exploitation requires the ability to provide unsanitized HTML input and system conditions that allow memory exhaustion. This vulnerability leads to information disclosure by confirming file existence remotely.

The vulnerability allows remote attackers to confirm the existence of sensitive local files on a server running vulnerable Dompdf versions by causing memory exhaustion errors when files exist and normal rendering when they do not. This information disclosure can aid attackers in mapping the server's file system and identifying sensitive files such as configuration files or keys. There is no direct code execution or file content disclosure, but the file existence oracle can facilitate further attacks.

No official patch or fix is currently confirmed for this vulnerability. Users should check the vendor advisory for updates. Until a fix is available, mitigate risk by sanitizing and validating all user-supplied HTML input to prevent injection of malicious CSS referencing local files. Additionally, configure PHP memory limits and Dompdf options to reduce the likelihood of memory exhaustion errors triggered by crafted inputs. Avoid allowing unrestricted HTML input to Dompdf rendering endpoints.