CVE-2026-107736 Details
Description
SumatraPDF is a multi-format reader for Windows. In 3.6.1 and earlier, MaybeFlipBitmap() asks GDI+ to read the attacker-controlled PropertyTagOrientation size through GetPropertyItem() while supplying only a fixed 64-byte buf on the stack. Opening a crafted TIFF with enough EXIF Orientation values can cause attacker-selected bytes to overwrite stack control data, while tested builds terminate through the stack cookie check. No broader impact is claimed beyond the advisory-supported conditions. No fixed version is available as of this review.
A stack buffer overflow vulnerability has been identified in SumatraPDF versions through 3.6.1. The issue arises in the 'MaybeFlipBitmap' function, where the application requests the size of the EXIF Orientation property from GDI+ and passes that size to 'GetPropertyItem' while only providing a fixed 64-byte buffer on the stack. This flaw can be exploited by crafting a TIFF file with multiple EXIF Orientation values, causing GDI+ to overwrite stack control data with attacker-selected bytes. Although the vulnerability was tested in builds that crash due to a stack cookie corruption, the advisory does not claim any broader impact.
As of now, no fixed version is available. However, the vulnerability can be addressed by rejecting EXIF Orientation property sizes that exceed the buffer limit before calling GDI+, and by validating the 'PropertyItem' type, length, and value pointer before accessing the Orientation values.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Oct 8, 2026CISA-ADP
Assessed Oct 9, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/sumatrapdfreader/sumatrapdf/commit/6fe2e0239d8ef3466174ac92f3f56e967ce1a4a7 | [email protected] | Source CodeVendor |
| https://github.com/sumatrapdfreader/sumatrapdf/security/advisories/GHSA-px68-7vwv-mxpr | [email protected] | AdvisoryExploitRemedyVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-121 | Stack-based Buffer Overflow | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| SumatraPDF | 3.6.1 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Oct 9, 2026 | CVE Modified | CISA-ADP |
| Oct 8, 2026 | New CVE Received | [email protected] |