CVE-2026-107737: SumatraPDF Buffer Overflow Vulnerability

CVE-2026-107737 Overview

CVE-2026-107737 is an out-of-bounds read vulnerability in SumatraPDF, a multi-format document reader for Windows. The flaw affects version 3.6.1 and earlier, plus pre-release 3.7.0.20369, when WebView2 is absent or fails to initialize. The ParseProtoUrl() function accepts a signed host component from an its:// URL, which FindHtmlWindowById() then uses directly as an index into the gHtmlWindows vector. Opening a crafted Compiled HTML Help (CHM) file through the Internet Explorer fallback backend with a negative or out-of-range window identifier triggers an out-of-bounds pointer read, an invalid object callback dereference, and process termination. The weakness is classified as [CWE-129] Improper Validation of Array Index.

Critical Impact
A crafted CHM document can crash SumatraPDF through an out-of-bounds pointer dereference when the IE fallback renderer is active. No fixed release is available at the time of this review.

Affected Products

SumatraPDF 3.6.1 and all earlier versions
SumatraPDF pre-release 3.7.0.20369
Installations where WebView2 is absent or fails to initialize (IE fallback backend)

Discovery Timeline

2026-10-08 - CVE-2026-107737 published to NVD
2026-10-13 - Last updated in NVD database

Technical Details for CVE-2026-107737

Vulnerability Analysis

SumatraPDF renders CHM files through either a WebView2 backend or a legacy Internet Explorer fallback backend. When WebView2 is unavailable, the IE path parses its:// URLs embedded in the CHM. The ParseProtoUrl() routine extracts the host component with %d formatting, yielding a signed integer. FindHtmlWindowById() then uses this value as a direct index into the gHtmlWindows vector without validating the bounds. A crafted CHM supplying a negative or oversized identifier forces an out-of-bounds read, which the code dereferences as an HtmlWindow pointer. The subsequent virtual callback invocation on arbitrary memory crashes the process.

Root Cause

The root cause is missing index validation on untrusted input. Vec::operator[] contains a ReportIf diagnostic check that still proceeds to read els[idx], so no runtime guard prevents the out-of-bounds access. The signed windowId is treated as a trusted array offset even though it originates from attacker-controlled document content.

Attack Vector

Exploitation requires local user interaction: the victim must open a malicious CHM in SumatraPDF on a system where WebView2 is missing or fails to initialize. The attacker delivers the crafted CHM through standard channels such as email attachments, downloads, or shared storage. Successful exploitation yields a denial-of-service outcome through process termination; integrity and confidentiality impacts are not reported.

cpp

 static Vec<HtmlWindow*> gHtmlWindows;
 
 HtmlWindow* FindHtmlWindowById(int windowId) {
+    // windowId comes from the its:// URL host (a signed %d parsed from a CHM),
+    // so a crafted document can pass a negative or out-of-range value. Reject it
+    // instead of indexing out of bounds (Vec::operator[]'s ReportIf is
+    // diagnostic-only and still reads els[idx]). Callers null-check the result.
+    if (!gHtmlWindows.isValidIndex(windowId)) {
+        return nullptr;
+    }
     return gHtmlWindows[windowId];
 }

Source: GitHub Commit 596c7e26 — the proposed patch adds an isValidIndex() bounds check and returns nullptr for invalid identifiers, relying on callers to null-check the result.

Detection Methods for CVE-2026-107737

Indicators of Compromise

Unexpected SumatraPDF crashes recorded in the Windows Application event log following CHM file access
Windows Error Reporting (WER) entries referencing SumatraPDF.exe with access-violation exception codes such as 0xC0000005
CHM files containing its:// URLs with negative or anomalously large host integer values
SumatraPDF processes launched on hosts where the Microsoft WebView2 runtime is not installed

Detection Strategies

Inspect CHM archives for embedded its:// links and flag host components that fail to parse as valid non-negative array indices.
Correlate SumatraPDF process termination events with recent file-open telemetry to identify suspicious documents.
Hunt for the IE fallback code path by detecting SumatraPDF processes without a loaded WebView2 module (Microsoft.Web.WebView2.*).

Monitoring Recommendations

Enable application crash telemetry collection on endpoints that process documents from external sources.
Track SumatraPDF version inventory across the fleet to prioritize hosts running 3.6.1 or earlier.
Alert on CHM delivery through email gateways or web proxies, as CHM is a legacy format with limited legitimate use.

How to Mitigate CVE-2026-107737

Immediate Actions Required

Restrict or block delivery of CHM files at email and web gateways until a patched SumatraPDF build is available.
Install or repair the Microsoft WebView2 Runtime on endpoints that use SumatraPDF, which bypasses the vulnerable IE fallback backend.
Avoid opening CHM documents from untrusted sources in SumatraPDF.

Patch Information

No fixed version has been released at the time of this review. A proposed source fix is tracked in GitHub Commit 596c7e26 and discussed in GitHub Security Advisory GHSA-8p34-f32f-7rmq. Monitor the upstream project for a release containing the isValidIndex() bounds check in FindHtmlWindowById().

Workarounds

Ensure the WebView2 Runtime is installed and functional so SumatraPDF never falls back to the IE CHM backend.
Use an alternative CHM viewer or convert CHM content to PDF or HTML on a controlled system.
Deploy application control policies that prevent SumatraPDF from opening files sourced from internet or email zones.

bash

# Verify WebView2 Runtime installation on Windows
reg query "HKLM\SOFTWARE\WOW6432Node\Microsoft\EdgeUpdate\Clients\{F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}" /v pv

# Install the Evergreen WebView2 Runtime (silent)
MicrosoftEdgeWebView2Setup.exe /silent /install