Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.

CVE-2026-107737: SumatraPDF may crash when opening crafted CHM files

CVE-2026-107737 · published 27 days ago

Summary

SumatraPDF versions up to 3.6.1 (and a pre‑release of 3.7) can stop working if a specially made CHM file is opened. The problem occurs when the program processes a certain type of link inside the file, causing it to read memory it shouldn't and then quit. Until the developer releases a fix, avoid opening CHM files from untrusted sources with SumatraPDF.

What to do

The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.

Affected software

Vendor	Product	Affected versions
sumatrapdfreader	sumatrapdf	<= 3.6.1

Original advisory text

SumatraPDF CHM `its://` signed index causes an out-of-bounds object lookup

SumatraPDF is a multi-format reader for Windows. In 3.6.1 and earlier, and in pre-release 3.7.0.20369 when WebView2 is absent or cannot initialize, ParseProtoUrl() accepts the signed host component of an its:// URL and FindHtmlWindowById() uses it directly as an index into gHtmlWindows. Opening a crafted CHM through the IE fallback backend with a negative or otherwise out-of-range window identifier can cause an out-of-bounds pointer read followed by an invalid object callback dereference and process termination. No fixed version is available as of this review.

References

https://github.com/sumatrapdfreader/sumatrapdf/security/advisories/GHSA-8p34-f32... Vendor Advisory
https://github.com/sumatrapdfreader/sumatrapdf/commit/596c7e26e983549a77a3a38cae... Patch
https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/107xxx/CVE-2026-1077... Vendor Advisory
https://nvd.nist.gov/vuln/detail/CVE-2026-107737 Vendor Advisory

Fix within

Internet-facing 60 days

Internal At next upgrade

Not known to be exploited
Needs hands-on effort to exploit
Gives an attacker partial control

Severity

7.3 High

Exploitation

<1% chance of attack within 30 days

Type

CWE-129Improper Validation of Array Index

Timeline

Published8 Oct 2026

Updated3 Nov 2026

First seen8 Oct 2026

Sources

CVE-2026-107737 · NVD

CVE-2026-107737 · MITRE

CVE-2026-107737 · OSV

GHSA-8p34-f32f-7rmq · GHSA

Track software like this

Free during beta