CVE-2026-107731: SumatraPDF Buffer Overflow Vulnerability

CVE-2026-107731 Overview

CVE-2026-107731 affects SumatraPDF, a multi-format document reader for Windows. The vulnerability exists in src/LitDoc.cpp within version 3.7.0.22298 and involves four independently reachable range-validation variants. File-controlled offsets and sizes can overflow, narrow to negative values, or wrap before incomplete bounds checks execute. Affected calculations include contentOffset, the directory expression dirOff64 + dirLen64, and the decoded-section offset + size, along with secondary-header range handling. Opening a crafted LIT file that reaches one of these variants triggers invalid pointer reads and deterministic application termination. The flaw is categorized under [CWE-125] Out-of-Bounds Read.

Critical Impact
A crafted LIT file can trigger invalid pointer reads and cause deterministic termination of the SumatraPDF process on the local system.

Affected Products

SumatraPDF version 3.7.0.22298
Windows builds of SumatraPDF processing LIT (Microsoft Reader) files
No fixed version is available as of this review

Discovery Timeline

2026-10-08 - CVE-2026-107731 published to NVD
2026-10-09 - Last updated in NVD database

Technical Details for CVE-2026-107731

Vulnerability Analysis

The flaw resides in LIT file parsing logic within src/LitDoc.cpp. The parser reads 32-bit values from attacker-controlled file content and uses them in arithmetic operations before validating boundary conditions. When these values are summed or cast, the result overflows the integer domain or narrows to a negative value. Subsequent comparisons against buffer length succeed because the overflowed value appears to satisfy the check. The parser then dereferences a pointer derived from the invalid offset. The result is an out-of-bounds read that produces a deterministic crash. Four independent variants exist, each tied to a distinct field: contentOffset, the directory tuple dirOff64 + dirLen64, the decoded-section offset + size, and secondary-header range handling.

Root Cause

The root cause is improper validation of integer arithmetic on file-controlled inputs. The vulnerable pattern checks pos + 8 <= len(sec) instead of pos <= len(sec) - 8. When pos approaches INT_MAX, the addition overflows and bypasses the length check. The same pattern repeats across the four calculation paths.

Attack Vector

Exploitation requires local user interaction. A victim must open a specially crafted LIT file in SumatraPDF. No network vector or elevated privileges are required. The impact is limited to availability through process termination; no code execution or data disclosure is claimed in the advisory.

cpp

         Str sec(d.s + off, std::min(secHdrLen, len(d) - off));
         int pos = (int)LitU32(sec, 4);
         bool haveContentOffset = false;
-        while (pos >= 0 && pos + 8 <= len(sec)) {
+        // pos comes from the file: compare without pos + 8 overflowing
+        while (pos >= 0 && pos <= len(sec) - 8) {
             Str blockTag(sec.s + pos, 4);
             u32 ver = LitU32(sec, pos + 4);
             if (str::Eq(blockTag, StrL("CAOL"))) {

Source: GitHub Commit 5d43b8c. The patch rewrites the comparison to prevent the addition from overflowing before validation.

Detection Methods for CVE-2026-107731

Indicators of Compromise

Unexpected SumatraPDF process crashes shortly after opening a LIT file from email, chat, or web download
Windows Error Reporting (WER) or Application event log entries citing access violation in SumatraPDF.exe with LIT file handles open
LIT files sourced from untrusted locations with abnormally large header offset fields

Detection Strategies

Monitor endpoint telemetry for repeated SumatraPDF.exe termination events correlated with recent file-open activity
Hunt for LIT files (*.lit) delivered through phishing campaigns or file-sharing channels on managed endpoints
Correlate process-crash signals with file-write events to identify the triggering document

Monitoring Recommendations

Enable crash dump collection for SumatraPDF.exe to confirm out-of-bounds read patterns during triage
Track file-reputation signals for LIT attachments at the mail gateway and web proxy
Alert on execution of SumatraPDF against files originating from the Downloads folder or temporary mail attachment paths

How to Mitigate CVE-2026-107731

Immediate Actions Required

Avoid opening LIT files from untrusted sources until a fixed SumatraPDF release is published
Block or quarantine .lit attachments at mail and web gateways where business justification is absent
Monitor the GitHub Security Advisory GHSA-753j-hx3p-xm9g for a fixed version announcement

Patch Information

No fixed version is available as of this review. The upstream commit 5d43b8c addresses the four range-validation variants by rewriting bounds checks to avoid overflow. Users should track the SumatraPDF project for an official release incorporating this change.

Workarounds

Disassociate the .lit file extension from SumatraPDF until a patched build is available
Enforce application allow-listing to restrict SumatraPDF execution to vetted document sources
Run SumatraPDF in a sandboxed or restricted user context to limit the blast radius of a crash

bash

# Remove the .lit file association for SumatraPDF (PowerShell, elevated)
ftype SumatraPDF.lit=
assoc .lit=