CVE-2026-107736: SumatraPDF Buffer Overflow Vulnerability

CVE-2026-107736 Overview

SumatraPDF, a multi-format document reader for Windows, contains a stack-based buffer overflow [CWE-121] in versions 3.6.1 and earlier. The flaw resides in MaybeFlipBitmap() inside src/ImageReader_win.cpp, where the function passes an attacker-controlled PropertyTagOrientation size to GDI+ GetPropertyItem() while providing only a fixed 64-byte stack buffer. A crafted TIFF file containing an oversized EXIF Orientation property can overwrite stack control data. Tested builds terminate via the stack cookie check, limiting observed impact to a crash.

Critical Impact

Opening a malicious TIFF in SumatraPDF 3.6.1 or earlier triggers a stack buffer overflow that corrupts return addresses and local variables, causing process termination through stack cookie enforcement.

Affected Products

• SumatraPDF 3.6.1
• SumatraPDF versions prior to 3.6.1
• Windows platform builds using the vulnerable ImageReader_win.cpp code path

Discovery Timeline

• 2026-10-08 - CVE-2026-107736 published to NVD
• 2026-10-09 - Last updated in NVD database

Technical Details for CVE-2026-107736

Vulnerability Analysis

The vulnerability lives in the MaybeFlipBitmap() helper that applies EXIF orientation to decoded images. The function allocates a fixed 64-byte stack buffer (u8 buf[64]) intended to hold a Gdiplus::PropertyItem structure, which is empirically about 26 bytes. It then queries the TIFF's PropertyTagOrientation size using GetPropertyItemSize() and calls GetPropertyItem() with that attacker-influenced size and the undersized stack buffer. When a TIFF supplies many Orientation values, propSize exceeds 64 bytes, and GDI+ writes past the buffer onto the stack frame. The pre-patch code contained only a diagnostic ReportIf(propSize > dimof(buf)) that did not stop execution, allowing the overflow to proceed.

Root Cause

The root cause is missing length validation on untrusted input before passing it to a Windows GDI+ API that performs a bounded copy against the caller-supplied size. Trusting GetPropertyItemSize() output as safe for a fixed stack destination violates the API contract for GetPropertyItem().

Attack Vector

Exploitation requires a local user to open a crafted TIFF file in SumatraPDF. User interaction is required, and no network vector exists. The attacker crafts a TIFF with an EXIF Orientation entry containing enough values that GetPropertyItemSize() returns more than 64 bytes.

 static void MaybeFlipBitmap(Bitmap* bmp) {
     u8 buf[64] = {}; // empirically is 26
 
+    // propSize is derived from the image's EXIF Orientation field, so a crafted
+    // TIFF can make it exceed buf (e.g. many Orientation values). GetPropertyItem
+    // would then write propSize bytes past the fixed stack buffer - a stack
+    // overflow. The ReportIf here used to be diagnostic-only and did not stop it,
+    // so reject an oversized property before calling GDI+.
     UINT propSize = bmp->GetPropertyItemSize(PropertyTagOrientation);
-    if (propSize == 0) {
+    if (propSize == 0 || propSize > dimof(buf)) {
         bmp->GetLastStatus(); // clear last status
         return;
     }
-    ReportIf(propSize > dimof(buf));
 
     auto status = bmp->GetPropertyItem(PropertyTagOrientation, propSize, (Gdiplus::PropertyItem*)buf);
     if (status != Status::Ok) {
         bmp->GetLastStatus(); // clear last status
         return;
     }
     auto propItem = (Gdiplus::PropertyItem*)buf;
+    // guard against a malformed/short property before reading the first value
+    if (!propItem->value || propItem->length < sizeof(u16)) {
+        return;
+    }
     u16* propValPtr = (u16*)propItem->value;
     ApplyExifOrientation(bmp, propValPtr[0]);
 }

Source: GitHub Commit 6fe2e02

Detection Methods for CVE-2026-107736

Indicators of Compromise

• Unexpected crashes of SumatraPDF.exe with Windows Error Reporting entries indicating stack buffer overrun (FAST_FAIL_STACK_COOKIE_CHECK_FAILURE, exception code 0xC0000409).
• TIFF files containing EXIF Orientation IFD entries with unusually large value counts, especially those producing a PropertyItem size greater than 64 bytes.
• Delivery of TIFF attachments from untrusted senders followed by renderer process termination.

Detection Strategies

• Scan file shares and mail gateways for TIFF files whose EXIF Orientation (0x0112) tag declares a value count that pushes the serialized PropertyItem beyond 64 bytes.
• Monitor endpoint telemetry for SumatraPDF.exe crashes correlated with recently opened TIFF or image files.
• Hunt for process creation chains in which SumatraPDF.exe is spawned by mail or browser processes followed by abnormal exit codes.

Monitoring Recommendations

• Enable and forward Windows Error Reporting and Application event logs to a central analytics platform for crash correlation.
• Alert on repeated termination of SumatraPDF.exe across multiple endpoints within a short window, which may indicate a malicious campaign.
• Capture and retain suspicious TIFF samples for offline analysis using a TIFF parser that enumerates IFD entry counts.

How to Mitigate CVE-2026-107736

Immediate Actions Required

• Avoid opening TIFF files from untrusted sources in SumatraPDF 3.6.1 or earlier until a fixed release is available.
• Remove file associations for .tif and .tiff from SumatraPDF on high-risk endpoints and route them to a hardened image viewer.
• Apply the upstream source patch from commit 6fe2e02 if building SumatraPDF from source.

Patch Information

No fixed release version is available as of this review. The source-level fix is published in the GitHub Commit 6fe2e02 and documented in the GitHub Security Advisory GHSA-px68-7vwv-mxpr. The patch rejects any PropertyTagOrientation whose size exceeds the 64-byte stack buffer before calling GetPropertyItem(), and adds a secondary guard against malformed short property values.

Workarounds

• Block inbound TIFF attachments at mail and web proxies where business requirements allow.
• Open untrusted image files inside a sandboxed virtual machine or application container to contain any crash or exploitation attempt.
• Enforce application control policies that restrict SumatraPDF execution to known-good document directories.

# Example: remove TIFF file associations for SumatraPDF on Windows
reg delete "HKCU\Software\Classes\.tif\OpenWithProgids" /v "SumatraPDF" /f
reg delete "HKCU\Software\Classes\.tiff\OpenWithProgids" /v "SumatraPDF" /f