CVE-2026-107738 in SumatraPDF
Summary
by MITRE • 10/09/2026
SumatraPDF is a multi-format reader for Windows. In 3.6.1 and earlier, ChmFile::GetCharZ() narrows file-controlled unsigned string offsets from /#WINDOWS and /#IVB to signed integers without a lower-bound check. An offset that becomes negative can make the function read before the /#STRINGS buffer, causing deterministic application termination. No broader impact is claimed beyond the advisory-supported conditions. No fixed version is available as of this review.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 10/09/2026
The vulnerability identified in SumatraPDF versions 3.6.1 and earlier represents a critical integer handling flaw within the CHM (Compiled HTML Help) file parser, specifically located in the ChmFile::GetCharZ() function. This component is responsible for processing internal structures of Microsoft Compiled HTML Help files, which are commonly used to distribute documentation and help systems on Windows platforms. The core technical issue stems from a type conversion error where unsigned string offsets derived from specific CHM sections, namely /#WINDOWS and /#IVB, are cast into signed integer variables without implementing necessary boundary checks. In C++ development, converting an unsigned value with a high bit set to a signed type results in sign extension, effectively turning what was intended as a large positive offset into a negative number due to two's complement representation rules.
This lack of lower-bound validation allows the application to interpret these corrupted or maliciously crafted offsets as valid memory addresses that reside before the start of the /#STRINGS buffer. When the parser attempts to read character data using this negated pointer, it accesses memory locations outside the allocated bounds of the string resource table. This out-of-bounds read operation violates standard memory safety principles and leads directly to deterministic application termination. The crash is consistent and reproducible when processing specifically crafted CHM files designed to exploit this specific arithmetic truncation error, indicating a clear denial of service vector rather than arbitrary code execution in most default configurations.
From an industry standards perspective, this vulnerability aligns with CWE-190 Integer Overflow or Wraparound, as the root cause is the improper handling of numeric values during type conversion that leads to unexpected negative results. Furthermore, it relates closely to CWE-787 Out-of-bounds Read, which describes accessing memory beyond the intended buffer boundary. In terms of attack vectors and tactics, this flaw can be leveraged within the MITRE ATT&CK framework under T1203 Exploitation for Defense Evasion or potentially as part of a broader initial access strategy if combined with other vulnerabilities to achieve code execution, although the current advisory limits the impact primarily to denial of service. The reliance on user interaction to open maliciously crafted CHM files places this in the context of social engineering attacks where an adversary might distribute such files via email or removable media.
The operational impact is significant for organizations relying on SumatraPDF as their primary document viewer, particularly those that receive technical documentation from external sources who may not validate file integrity rigorously. While no broader remote code execution has been confirmed in this specific advisory context, the deterministic crash disrupts workflow and can be used to destabilize systems or distract security personnel during an incident response scenario. The absence of a fixed version as of the review date necessitates immediate reliance on mitigating controls rather than patching.
To mitigate this risk, administrators should restrict the execution of SumatraPDF for untrusted users or implement application whitelisting policies that prevent the opening of CHM files from network locations or email attachments unless explicitly approved by security teams. Users are advised to avoid opening .chm files received via unsolicited communications and to verify the source integrity before rendering such documents. Additionally, deploying endpoint detection and response solutions with behavioral monitoring capabilities can help identify anomalous process termination patterns associated with this specific memory access violation. Until a vendor-patched version is released, maintaining strict control over which file types are processed by PDF readers remains the most effective defense against exploitation of this integer truncation flaw.