CVE-2026-107738: SumatraPDF: Untrusted binary record offset used without lower-bound validation
SumatraPDF is a multi-format reader for Windows. In 3.6.1 and earlier, ChmFile::GetCharZ() narrows file-controlled unsigned string offsets from /#WINDOWS and /#IVB to signed integers without a lower-bound check. An offset that becomes negative can make the function read before the /#STRINGS buffer, causing deterministic application termination. No broader impact is claimed beyond the advisory-supported conditions. No fixed version is available as of this review.
Affected Software
Event History
Frequently Asked Questions
Who is exposed to this issue?
Systems running SumatraPDF 3.6.1 or earlier are affected when they process a crafted CHM file containing attacker-controlled offsets in the /#WINDOWS or /#IVB records.
What does an attacker need to do to trigger the vulnerability?
An attacker needs to cause SumatraPDF to process a malicious CHM file with an unsigned string offset that becomes negative after conversion to a signed integer. The documented result is deterministic application termination from a read before the /#STRINGS buffer.
Is a fix available?
No fixed version was available as of the review. The advisory references a commit, but the provided information does not identify a released version containing the fix.
What is the expected impact?
The stated impact is application termination under the advisory-supported conditions. No broader impact is claimed in the provided advisory information.