CVE-2026-88361: SumatraPDF Buffer Overflow Vulnerability

CVE-2026-88361 Overview

CVE-2026-88361 is an integer overflow vulnerability in SumatraPDF 3.6.1. The flaw resides in EngineMupdf::BuildPageLabelRec() within src/EngineMupdf.cpp, which parses the /Nums entries of a PDF PageLabels dictionary. An attacker can craft a PDF whose /Nums key is a signed 32-bit integer at or near INT_MAX. Adding one to that value triggers signed integer overflow, resulting in undefined behavior and application crash. The issue is tracked as GitHub issue #5952 and classified under CWE-190: Integer Overflow or Wraparound.

Critical Impact
A malicious PDF opened in SumatraPDF 3.6.1 can crash the viewer through attacker-controlled integer overflow, causing availability loss on the targeted system.

Affected Products

SumatraPDF 3.6.1 (EngineMupdf.cpp, function BuildPageLabelRec())
SumatraPDF builds that include the vulnerable MuPDF engine integration prior to the referenced commits
Downstream forks of SumatraPDF that have not merged the upstream fix

Discovery Timeline

2026-09-24 - CVE-2026-88361 published to NVD
2026-09-25 - Last updated in NVD database

Technical Details for CVE-2026-88361

Vulnerability Analysis

SumatraPDF uses MuPDF to parse the PDF PageLabels dictionary. The /Nums array alternates integer keys and label-definition dictionaries. The vulnerable code reads each integer key with pdf_to_int(), stores it in a native int, and adds 1 before range-checking the result.

When the attacker supplies INT_MAX as the key, the expression pdf_to_int(...) + 1 overflows a signed 32-bit integer. The subsequent if (pli.startAt < 1) guard cannot catch the overflow reliably because signed overflow is undefined behavior in C/C++. The same arithmetic weakness applies to the /St (countFrom) field, which is later added to a per-page index in BuildPageLabelVec, producing a second overflow site.

Root Cause

The root cause is unchecked arithmetic on an attacker-controlled signed integer before validation. The original code performs pdf_to_int(...) + 1 in int width, then validates the already-overflowed result. CWE-190 applies directly: a bounds check on a value that has already wrapped cannot enforce the intended invariant.

Attack Vector

Exploitation requires a victim to open a crafted PDF with SumatraPDF 3.6.1. The attack vector is network-reachable because PDFs are routinely delivered via email, web downloads, and file shares. No authentication or user interaction beyond opening the document is required for the overflow to trigger. The documented impact is on availability; the vulnerability causes undefined behavior that manifests as a crash of the viewer process.

cpp

     for (int i = 0; i < n; i += 2) {
         pdf_obj* info = pdf_array_get(ctx, obj, i + 1);
         PageLabelInfo pli;
-        pli.startAt = pdf_to_int(ctx, pdf_array_get(ctx, obj, i)) + 1;
-        if (pli.startAt < 1) {
+        // the key is attacker-controlled: INT_MAX + 1 in int is signed
+        // overflow, undefined behavior (issue #5952)
+        i64 startAt = (i64)pdf_to_int(ctx, pdf_array_get(ctx, obj, i)) + 1;
+        if (startAt < 1 || startAt > (i64)pageCount) {
             continue;
         }
+        pli.startAt = (int)startAt;
 
         pli.type = pdf_to_name(ctx, pdf_dict_gets(ctx, info, "S"));
         pli.prefix = pdf_dict_gets(ctx, info, "P");
         pli.countFrom = pdf_to_int(ctx, pdf_dict_gets(ctx, info, "St"));
-        if (pli.countFrom < 1) {
-            pli.countFrom = 1;
-        }
+        // BuildPageLabelVec computes countFrom + j for j < pageCount: keep the
+        // sum representable for an attacker-controlled /St near INT_MAX
+        pli.countFrom = limitValue(pli.countFrom, 1, INT_MAX - pageCount);
         data.Append(pli);
     }
 }

Source: GitHub commit b22a8c7. The patch widens the arithmetic to i64 before validation and clamps countFrom so that countFrom + pageCount remains representable in int.

Detection Methods for CVE-2026-88361

Indicators of Compromise

Unexpected termination of SumatraPDF.exe immediately after a PDF is opened, often with a Windows Error Reporting (WER) entry referencing EngineMupdf.cpp.
PDF files whose PageLabels dictionary contains /Nums integer keys at or near 2147483647 (INT_MAX) or large /St values.
Recurring crash dumps that stack-trace through BuildPageLabelRec or BuildPageLabelVec.

Detection Strategies

Scan inbound PDFs with a parser that enumerates the PageLabels tree and flags any /Nums key where |value| > pageCount or where value >= INT_MAX - 1.
Correlate email, web proxy, and file-share telemetry with endpoint process-crash events for SumatraPDF.exe to identify delivery of malicious documents.
Hunt for anomalous child-process termination of PDF viewers following document open events in EDR telemetry.

Monitoring Recommendations

Alert on repeated SumatraPDF.exe crash events on the same host or across multiple hosts receiving similar attachments.
Monitor mail gateway logs for PDF attachments that fail structural validation of the PageLabels dictionary.
Track SumatraPDF versions deployed across the estate to confirm vulnerable 3.6.1 builds are being retired.

How to Mitigate CVE-2026-88361

Immediate Actions Required

Inventory all endpoints running SumatraPDF 3.6.1 and prioritize updating or removing the vulnerable builds.
Block or quarantine untrusted PDF attachments at the mail gateway until patched builds are deployed.
Advise users not to open PDFs from unknown senders in SumatraPDF 3.6.1.

Patch Information

The fix is published in the SumatraPDF source tree in src/EngineMupdf.cpp. Two reference commits implement the same correction: widening the arithmetic to a 64-bit integer before the range check, and clamping countFrom with limitValue(pli.countFrom, 1, INT_MAX - pageCount). See the chenjiefeng2001 patch commit and the haimag patch commit. Rebuild SumatraPDF from source with these patches applied, or deploy an official release that incorporates the fix for issue #5952.

Workarounds

Replace SumatraPDF 3.6.1 with an alternative PDF reader on at-risk endpoints until a patched build is available.
Strip or normalize the PageLabels dictionary from inbound PDFs using a server-side PDF sanitizer.
Open untrusted PDFs only inside an isolated sandbox or virtual machine to contain any crash impact.

bash

# Example: identify SumatraPDF 3.6.1 installations on Windows endpoints
Get-ChildItem -Path 'C:\Program Files','C:\Program Files (x86)','C:\Users' `
  -Recurse -Filter 'SumatraPDF.exe' -ErrorAction SilentlyContinue |
  ForEach-Object {
    $v = (Get-Item $_.FullName).VersionInfo.ProductVersion
    [pscustomobject]@{ Path = $_.FullName; Version = $v; Vulnerable = ($v -like '3.6.1*') }
  } | Where-Object Vulnerable | Format-Table -AutoSize