CVE-2026-107737: SumatraPDF CHM `its://` signed index causes an out-of-bounds object lookup
SumatraPDF is a multi-format reader for Windows. In 3.6.1 and earlier, and in pre-release 3.7.0.20369 when WebView2 is absent or cannot initialize, ParseProtoUrl() accepts the signed host component of an its:// URL and FindHtmlWindowById() uses it directly as an index into gHtmlWindows. Opening a crafted CHM through the IE fallback backend with a negative or otherwise out-of-range window identifier can cause an out-of-bounds pointer read followed by an invalid object callback dereference and process termination. No fixed version is available as of this review.
Affected Software
Event History
Frequently Asked Questions
Which installations are exposed to this issue?
SumatraPDF 3.6.1 and earlier are affected. The pre-release 3.7.0.20369 is also affected when WebView2 is absent or cannot initialize, causing CHM content to use the IE fallback backend.
What does an attacker need to exploit the vulnerability?
An attacker needs a user to open a crafted CHM file through the IE fallback backend. The CHM must contain an its:// URL with a negative or otherwise out-of-range window identifier.
What is the practical impact of successful exploitation?
The malformed identifier can cause an out-of-bounds pointer read followed by an invalid object callback dereference. The described outcome is process termination.
What can be done while no fixed version is available?
Avoid opening untrusted CHM files in affected SumatraPDF installations. Ensuring WebView2 is available and initializes avoids the specifically described IE fallback condition in pre-release 3.7.0.20369.