CVE-2026-107738 Details
Description
SumatraPDF is a multi-format reader for Windows. In 3.6.1 and earlier, ChmFile::GetCharZ() narrows file-controlled unsigned string offsets from /#WINDOWS and /#IVB to signed integers without a lower-bound check. An offset that becomes negative can make the function read before the /#STRINGS buffer, causing deterministic application termination. No broader impact is claimed beyond the advisory-supported conditions. No fixed version is available as of this review.
A denial-of-service vulnerability has been identified in SumatraPDF versions through 3.6.1. The issue arises in the CHM file parser, specifically within the 'ChmFile::GetCharZ()' function. Here, file-controlled unsigned string offsets are improperly converted to signed integers without adequate lower-bound validation. This oversight allows negative offsets to be introduced, causing the application to read before the designated buffer and leading to a crash. While the vulnerability currently only causes application termination, the potential for sensitive memory disclosure exists, although it has not been demonstrated.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Oct 8, 2026CISA-ADP
Assessed Oct 14, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/sumatrapdfreader/sumatrapdf/commit/62254ed6d781ceb5cd16489bb423e7f591cd72c4 | [email protected] | Source CodeVendor |
| https://github.com/sumatrapdfreader/sumatrapdf/security/advisories/GHSA-33jg-vxm6-8mxx | [email protected] | AdvisoryTechnical DescriptionVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-125 | Out-of-bounds Read | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| SumatraPDF | 3.6.1 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Oct 14, 2026 | CVE Modified | CISA-ADP |
| Oct 8, 2026 | New CVE Received | [email protected] |