CVE-2026-107737: medium-severity vulnerability in sumatrapdfreader sumatrapdf
SumatraPDF CHM `its://` signed index causes an out-of-bounds object lookup
Published · Updated
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
13Vexday Risk Score
No sign of exploitation. No public exploitation artifact known so far.
ssvc Trackcvss 5.7epss 0.2%
SumatraPDF is a multi-format reader for Windows. In 3.6.1 and earlier, and in pre-release 3.7.0.20369 when WebView2 is absent or cannot initialize, ParseProtoUrl() accepts the signed host component of an its:// URL and FindHtmlWindowById() uses it directly as an index into gHtmlWindows. Opening a crafted CHM through the IE fallback backend with a negative or otherwise out-of-range window identifier can cause an out-of-bounds pointer read followed by an invalid object callback dereference and process termination. No fixed version is available as of this review.
CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
Affected products
sumatrapdfreader · sumatrapdfRelated CVEs — sumatrapdfreader sumatrapdf
In the same product, most dangerous first.
CVE-2026-25961HIGHSumatraPDF Update MITM -> Arbitrary Code ExecutionEPSS 0.4%CVE-2026-25920MEDIUMSumatraPDF has a heap out-of-bounds read in MOBI HuffDic decompressorEPSS 0.3%CVE-2026-23512HIGHSumatraPDF has an Untrusted Search Path in sumatrapdf/src/AppTools.cppEPSS 0.2%CVE-2026-25880HIGHUntrusted Search Path in SumatraPDF Reader (explorer.exe on Windows)EPSS 0.2%CVE-2026-23951MEDIUMSumatraPDF's Integer Underflow in PalmDbReader Leads to CrashEPSS 0.2%CVE-2026-26054MEDIUMSumatraPDF: Heap out-of-bounds read in MOBI header parser.EPSS 0.2%