CVE-2026-55586 in SumatraPDF
Summary
by MITRE • 08/20/2026
SumatraPDF is a multi-format reader for Windows. In 3.6.1 and earlier, a crafted CHM file can supply malformed LZX Huffman code lengths to make_decode_table in ext/CHMLib/lzx.c. In the long-code branch, the function writes new internal nodes through next_symbol before validating that the canonical Huffman table has overflowed. The PRETREE case can write beyond the 104-entry PRETREE_table into adjacent heap state in struct LZXstate when reached through chm_open, chm_retrieve_object, LZXdecompress, and BUILD_TABLE. This produces heap memory corruption in the parser process, while arbitrary code execution has not been demonstrated. No fixed version is available as of this review.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 08/20/2026
SumatraPDF serves as a widely utilized multi-format document reader for Windows operating systems, supporting various file types including PDF, eBook formats, and Microsoft Compiled HTML Help files known as CHM. The software relies on external libraries to handle the parsing and decompression of these complex binary structures. Within versions 3.6.1 and earlier, a critical vulnerability exists in the handling of LZX compressed data streams found within CHM files. This flaw is located specifically within the ext/CHMLib/lzx.c module, which implements the LZX compression algorithm used by Microsoft for its help file format. The core issue arises when processing crafted input that contains malformed LZX Huffman code lengths, triggering a logic error during the construction of decoding tables.
The technical root cause involves an incorrect order of operations within the make_decode_table function in the long-code branch of the LZX implementation. When constructing the canonical Huffman table, the software is designed to validate whether the table has overflowed its allocated bounds before proceeding with further processing steps that modify internal state structures. However, due to this vulnerability, the code writes new internal nodes through the next_symbol mechanism prior to performing the necessary validation checks for table overflow. This sequence error means that invalid or excessively long codes are processed without first ensuring they fit within the expected structural limits of the decompression engine's data structures.
This logic flaw has severe implications when triggered via specific entry points such as chm_open, chm_retrieve_object, LZXdecompress, and BUILD_TABLE. Specifically, in the PRETREE case, which handles pre-tree decoding for certain symbol sets, the function writes beyond the boundaries of the fixed 104-entry PRETREE_table array. Because this buffer is embedded within the struct LZXstate object on the heap, writing past its end results in adjacent memory corruption. This constitutes a classic out-of-bounds write vulnerability that corrupts heap metadata or neighboring data structures within the parser process. Such corruption can lead to application crashes, denial of service conditions, and potentially more severe outcomes if an attacker can precisely control the overwritten memory contents.
From a classification perspective, this vulnerability aligns with CWE-787: Out-of-bounds Write, as it involves writing data beyond the allocated buffer boundaries. It also relates to CWE-20: Improper Input Validation, since the system fails to adequately verify that Huffman code lengths are valid before processing them into internal tables. In terms of attack vectors and techniques, this flaw is exploitable through maliciously crafted CHM files delivered via phishing emails or compromised websites, mapping to MITRE ATT&CK technique T1204: User Execution. The attacker must trick the user into opening a specially constructed document that triggers the malformed LZX stream processing path within SumatraPDF.
The operational impact of this vulnerability is primarily heap memory corruption in the context of the parser process. While arbitrary code execution has not been demonstrated or confirmed for this specific flaw, the nature of heap overwrites inherently carries significant risk. Corrupted heap structures can be manipulated to alter control flow during subsequent memory allocations or frees, potentially leading to remote code execution under certain conditions and compiler configurations. The lack of a fixed version as of the review period leaves users exposed unless they employ workarounds such as disabling CHM file support within SumatraPDF settings or using alternative document viewers that do not rely on the vulnerable LZX implementation. Mitigation strategies should focus on input sanitization at the library level to ensure Huffman tables are validated for overflow before any node modifications occur, and organizations should consider restricting the use of CHM files in high-security environments until a patch is released.