CVE-2026-107738: SumatraPDF Buffer Overflow Vulnerability

CVE-2026-107738 Overview

CVE-2026-107738 is an out-of-bounds read vulnerability [CWE-125] in SumatraPDF, a multi-format document reader for Windows. The flaw resides in the ChmFile::GetCharZ() function, which parses Compiled HTML Help (CHM) files. The function narrows file-controlled unsigned string offsets from the /#WINDOWS and /#IVB streams to signed integers without a lower-bound check. A negative offset causes the function to read memory before the /#STRINGS buffer, triggering deterministic application termination. The vulnerability affects SumatraPDF version 3.6.1 and earlier, and no fixed release is available at the time of this review.

Critical Impact
A crafted CHM file can crash SumatraPDF through an out-of-bounds read, resulting in loss of availability for the local user process.

Affected Products

SumatraPDF 3.6.1
All prior SumatraPDF releases that include ChmFile::GetCharZ()
Windows installations using SumatraPDF to open CHM documents

Discovery Timeline

2026-10-08 - CVE-2026-107738 published to the National Vulnerability Database
2026-10-14 - Last updated in NVD database

Technical Details for CVE-2026-107738

Vulnerability Analysis

The vulnerability occurs in src/ChmFile.cpp within the ChmFile::GetCharZ() helper, which retrieves null-terminated strings from a CHM /#STRINGS buffer. The function accepts an int off offset but receives values originally parsed as unsigned 32-bit DWORDs from attacker-controlled CHM metadata streams. When a DWORD exceeds INT_MAX, narrowing conversion produces a negative integer. The original bounds check only validated the upper bound (off >= n), allowing negative offsets to pass. The subsequent pointer arithmetic data + off then dereferences memory before the buffer's base address.

A single malformed CHM file is sufficient to trigger the condition when a user opens the document. Exploitation requires local user interaction, and impact is limited to availability of the SumatraPDF process.

Root Cause

The root cause is a missing lower-bound validation combined with an unsigned-to-signed integer narrowing conversion. CHM internal streams /#WINDOWS and /#IVB store string offsets as unsigned DWORDs. The parser converts these to int without verifying the value fits in the signed range, producing negative offsets that bypass the sole off >= n check.

Attack Vector

An attacker crafts a CHM file containing a /#WINDOWS or /#IVB entry whose string offset exceeds 0x7FFFFFFF. The victim opens the file in SumatraPDF 3.6.1 or earlier. The parser reads bytes before the /#STRINGS allocation, yielding deterministic process termination through an access violation.

cpp

// Patched ChmFile::GetCharZ() - Source: https://github.com/sumatrapdfreader/sumatrapdf/commit/62254ed6d781ceb5cd16489bb423e7f591cd72c4
static Str GetCharZ(Str d, int off) {
    // off comes from file-controlled unsigned DWORDs narrowed to int, so it can
    // be negative; reject that along with the upper bound to avoid an OOB read.
    if (off < 0 || off >= d.len) {
        return {};
    }
    char* start = d.s + off;
    size_t remaining = (size_t)(d.len - off);
    char* end = (char*)memchr(start, '\0', remaining);
    if (!end) {
        return {};
    }
    int slen = (int)(end - start);
    if (slen == 0) {
        return {};
    }
    return str::Dup(Str(start, slen));
}

The patch adds off < 0 validation before any pointer arithmetic, closing the lower-bound gap. See the GitHub commit and the GHSA-33jg-vxm6-8mxx advisory for full details.

Detection Methods for CVE-2026-107738

Indicators of Compromise

Unexpected SumatraPDF process crashes immediately after opening a CHM file
Windows Error Reporting (WER) events for SumatraPDF.exe with access violation (0xC0000005) in ChmFile.cpp call stacks
CHM files from untrusted sources containing oversized DWORD values in /#WINDOWS or /#IVB streams

Detection Strategies

Scan inbound CHM attachments and downloads for anomalous /#WINDOWS or /#IVB offset values greater than 0x7FFFFFFF
Correlate email gateway and web proxy logs for CHM delivery followed by endpoint crash telemetry
Monitor EDR process-termination events on SumatraPDF.exe associated with recent file open operations

Monitoring Recommendations

Enable Windows Error Reporting collection for user-mode crashes on endpoints running SumatraPDF
Alert on repeated SumatraPDF.exe crashes across multiple endpoints, which may indicate targeted CHM distribution
Track SumatraPDF versions across the fleet to identify hosts still running 3.6.1 or earlier

How to Mitigate CVE-2026-107738

Immediate Actions Required

Restrict opening CHM files from untrusted sources until a patched SumatraPDF release is available
Block inbound .chm attachments at the email gateway where business workflows allow
Inventory endpoints running SumatraPDF 3.6.1 or earlier and prioritize upgrades once a fixed version ships

Patch Information

No fixed SumatraPDF release is available as of this review. The upstream fix has been committed to the project repository in commit 62254ed and will be included in a future build. Monitor the GHSA-33jg-vxm6-8mxx advisory for release information.

Workarounds

Use an alternative CHM reader for untrusted help files until a patched SumatraPDF build is published
Apply Windows Attachment Manager policies to flag .chm downloads from the Internet zone
Deploy application control policies to prevent SumatraPDF from opening CHM files sourced from user download directories

bash

# PowerShell: inventory SumatraPDF installations and versions across endpoints
Get-ChildItem -Path 'C:\Program Files\SumatraPDF','C:\Program Files (x86)\SumatraPDF' -Filter 'SumatraPDF.exe' -ErrorAction SilentlyContinue |
    ForEach-Object {
        [PSCustomObject]@{
            Path    = $_.FullName
            Version = (Get-Item $_.FullName).VersionInfo.FileVersion
        }
    }

# Block .chm attachments at Exchange transport (example rule)
New-TransportRule -Name 'Block CHM Attachments' `
    -AttachmentExtensionMatchesWords 'chm' `
    -RejectMessageReasonText 'CHM attachments blocked pending CVE-2026-107738 patch'