CVE-2026-107736 in SumatraPDF
Summary
by MITRE • 10/09/2026
SumatraPDF is a multi-format reader for Windows. In 3.6.1 and earlier, MaybeFlipBitmap() asks GDI+ to read the attacker-controlled PropertyTagOrientation size through GetPropertyItem() while supplying only a fixed 64-byte buf on the stack. Opening a crafted TIFF with enough EXIF Orientation values can cause attacker-selected bytes to overwrite stack control data, while tested builds terminate through the stack cookie check. No broader impact is claimed beyond the advisory-supported conditions. No fixed version is available as of this review.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 10/09/2026
SumatraPDF serves as a widely utilized multi-format document viewer for Windows operating systems, supporting various file types including PDF, eBook formats, and notably TIFF images. The vulnerability identified in versions 3.6.1 and earlier centers on the improper handling of metadata within Tagged Image File Format files, specifically concerning EXIF Orientation tags. This flaw manifests during the processing phase when the application attempts to render image data by invoking the MaybeFlipBitmap function. Within this routine, SumatraPDF interacts with GDI+ through the GetPropertyItem API call to retrieve orientation properties embedded in the TIFF file header. The critical technical deficiency lies in how memory is allocated and managed for storing these retrieved property items.
The core of the vulnerability is a stack-based buffer overflow caused by an insufficiently sized destination buffer. When SumatraPDF requests property item data via GetPropertyItem, it provides a fixed-size buffer on the stack that is only sixty-four bytes long. However, the size of the PropertyTagOrientation value is derived directly from the attacker-controlled TIFF file metadata without adequate validation or bounds checking against this static limit. If an adversary crafts a malicious TIFF file containing EXIF Orientation values with sizes exceeding sixty-four bytes, the subsequent copy operation will write data beyond the allocated stack space. This results in the overwriting of adjacent memory locations on the call stack, which may include critical control data such as return addresses or frame pointers.
From an operational impact perspective, this vulnerability allows for potential arbitrary code execution if the attacker can successfully overwrite sufficient stack control structures to redirect program flow. Although current tested builds terminate execution due to modern compiler protections like stack cookies (canaries), these mechanisms are not universally present in all deployment environments and may be bypassed through specific exploitation techniques or by targeting systems with older toolchains that lack such mitigations. The advisory suggests no broader impact beyond the conditions supported, implying that successful exploitation is contingent upon precise crafting of the input file to trigger the overflow without immediate termination by security checks. This limitation does not negate the severity but rather defines the attack surface as dependent on specific binary configurations and protection mechanisms in place at runtime.
This vulnerability aligns with Common Weakness Enumeration standard CWE-121, which describes a stack-based buffer overflow where data is written beyond the bounds of a fixed-size stack buffer. It also relates to CWE-787, an out-of-bounds write that occurs due to incorrect boundary calculations or missing validation checks on input sizes. In terms of adversary tactics and techniques, this flaw facilitates initial access through malicious file delivery, corresponding to MITRE ATT&CK technique T1204. The exploitation vector relies heavily on social engineering or automated distribution mechanisms to trick users into opening the crafted TIFF files, leveraging the trust placed in PDF readers to execute arbitrary code upon rendering specific media content.
Mitigation strategies for this vulnerability are currently limited by the absence of a fixed version as noted in the review period. Organizations relying on SumatraPDF should consider implementing application whitelisting or strict file type filtering policies to prevent execution from untrusted directories or sources. Additionally, deploying endpoint detection and response solutions that monitor for anomalous memory access patterns or stack corruption events can provide an additional layer of defense against exploitation attempts. Users are advised to exercise caution when opening TIFF files obtained from unknown or untrusted origins until a patched version is released by the vendor. Until then, restricting the use of SumatraPDF to trusted environments and minimizing exposure to external file inputs remains the most effective risk reduction approach available under current conditions.