CVE-2026-107737 Details
Description
SumatraPDF is a multi-format reader for Windows. In 3.6.1 and earlier, and in pre-release 3.7.0.20369 when WebView2 is absent or cannot initialize, ParseProtoUrl() accepts the signed host component of an its:// URL and FindHtmlWindowById() uses it directly as an index into gHtmlWindows. Opening a crafted CHM through the IE fallback backend with a negative or otherwise out-of-range window identifier can cause an out-of-bounds pointer read followed by an invalid object callback dereference and process termination. No fixed version is available as of this review.
A vulnerability in SumatraPDF versions through 3.6.1 and the pre-release 3.7.0.20369 (when WebView2 is unavailable or fails to initialize) allows for an out-of-bounds pointer read and invalid object callback dereference, leading to process termination. This occurs through the 'its://' URL protocol used for CHM files, where a crafted CHM can exploit the vulnerability by sending a negative or out-of-range window identifier. The issue is present in the application's Internet Explorer fallback backend, which is intentionally retained.
As of now, there is no fixed version available. However, the vulnerability can be addressed by validating the parsed window ID before indexing into the 'gHtmlWindows' vector, ensuring that it is non-negative and within the valid range.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Oct 8, 2026CISA-ADP
Assessed Oct 13, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/sumatrapdfreader/sumatrapdf/security/advisories/GHSA-8p34-f32f-7rmq | CISA-ADP | AdvisoryExploitRemedyVendor |
| https://github.com/sumatrapdfreader/sumatrapdf/commit/596c7e26e983549a77a3a38cae1147ab73792929 | [email protected] | Source CodeVendor |
| https://github.com/sumatrapdfreader/sumatrapdf/security/advisories/GHSA-8p34-f32f-7rmq | [email protected] | AdvisoryExploitRemedyVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-129 | Improper Validation of Array Index | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| SumatraPDF | 3.6.1 (semver) 3.7.0.20369 |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Oct 13, 2026 | CVE Modified | CISA-ADP |
| Oct 8, 2026 | New CVE Received | [email protected] |