CVE-2026-107731: SumatraPDF: LIT parser range-validation flaws cause invalid-pointer reads and denial of service
SumatraPDF is a multi-format reader for Windows. In 3.7.0.22298, four independently reachable range-validation variants in src/LitDoc.cpp allow file-controlled offsets and sizes to overflow, narrow to negative values, or wrap before incomplete bounds checks. The affected calculations include contentOffset, the directory expression dirOff64 + dirLen64, and the decoded-section offset + size, along with secondary-header range handling. Opening a crafted LIT file that reaches one of these variants can cause invalid pointer reads and deterministic application termination. No broader impact is claimed beyond the advisory-supported conditions. No fixed version is available as of this review.
Affected Software
Event History
Frequently Asked Questions
Who is exposed to this issue?
Users of SumatraPDF 3.7.0.22298 who open LIT files are exposed. The issue is in the LIT parser and can cause the application to terminate.
What does an attacker need to exploit it?
An attacker needs to provide a crafted LIT file and have the user open it in SumatraPDF. The listed vector indicates local attack access, no privileges required, and user interaction required.
Is a fixed version available?
No fixed version was available as of the review described in the advisory.
What can be done if patching is not available?
Avoid opening untrusted LIT files in the affected application until a fixed version is available. The advisory describes exploitation through crafted LIT files reaching the affected parser paths.