vuln-chm-hijack

PuTTY vulnerability vuln-chm-hijack Potential malicious code execution via CHM hijacking About Up to and including version 0.70, when you launched the online help in any of the Windows PuTTY GUI tools, the tool would locate its help file by looking alongside its own executable. If you were runnin...

CVE-2022-29072

7-Zip CVE 2022-29072 - Powershell Detection/Mitigation The deletion of the offending CHM file is commented out. Uncommenting causes the script to forcefully delete files - use at your own risk! If submitting a PR with a new hash please provide file as well for verification...

CVE-2026-107737

SumatraPDF is a multi-format reader for Windows. In 3.6.1 and earlier, and in pre-release 3.7.0.20369 when WebView2 is absent or cannot initialize, ParseProtoUrl accepts the signed host component of an its:// URL and FindHtmlWindowById uses it directly as an index into gHtmlWindows. Opening a...

CVE-2026-107737 SumatraPDF CHM `its://` signed index causes an out-of-bounds object lookup

SumatraPDF is a multi-format reader for Windows. In 3.6.1 and earlier, and in pre-release 3.7.0.20369 when WebView2 is absent or cannot initialize, ParseProtoUrl accepts the signed host component of an its:// URL and FindHtmlWindowById uses it directly as an index into gHtmlWindows. Opening a...

CVE-2026-107737 SumatraPDF CHM `its://` signed index causes an out-of-bounds object lookup

SumatraPDF is a multi-format reader for Windows. In 3.6.1 and earlier, and in pre-release 3.7.0.20369 when WebView2 is absent or cannot initialize, ParseProtoUrl accepts the signed host component of an its:// URL and FindHtmlWindowById uses it directly as an index into gHtmlWindows. Opening a...

CVE-2026-107737

The multi-format reader SumatraPDF for Windows is vulnerable to an out-of-bounds object lookup in versions 3.6.1 and earlier , and in pre-release 3.7.0.20369 when WebView2 is absent or fails to initialize. The root cause lies in the ParseProtoUrl() function, which accepts the signed host componen...

CVE-2026-55586

SumatraPDF is a multi-format reader for Windows. In 3.6.1 and earlier, a crafted CHM file can supply malformed LZX Huffman code lengths to makedecodetable in ext/CHMLib/lzx.c. In the long-code branch, the function writes new internal nodes through nextsymbol before validating that the canonical...

EUVD-2026-63469

SumatraPDF is a multi-format reader for Windows. In 3.6.1 and earlier, a crafted CHM file can supply malformed LZX Huffman code lengths to makedecodetable in ext/CHMLib/lzx.c. In the long-code branch, the function writes new internal nodes through nextsymbol before validating that the canonical...

CVE-2026-55586 SumatraPDF: Heap out-of-bounds write in vendored CHMLib LZX Huffman table construction reachable from crafted CHM files

SumatraPDF is a multi-format reader for Windows. In 3.6.1 and earlier, a crafted CHM file can supply malformed LZX Huffman code lengths to makedecodetable in ext/CHMLib/lzx.c. In the long-code branch, the function writes new internal nodes through nextsymbol before validating that the canonical...

CVE-2026-55586 SumatraPDF: Heap out-of-bounds write in vendored CHMLib LZX Huffman table construction reachable from crafted CHM files

SumatraPDF is a multi-format reader for Windows. In 3.6.1 and earlier, a crafted CHM file can supply malformed LZX Huffman code lengths to makedecodetable in ext/CHMLib/lzx.c. In the long-code branch, the function writes new internal nodes through nextsymbol before validating that the canonical...

CVE-2026-55586 SumatraPDF: Heap out-of-bounds write in vendored CHMLib LZX Huffman table construction reachable from crafted CHM files

SumatraPDF is a multi-format reader for Windows. In 3.6.1 and earlier, a crafted CHM file can supply malformed LZX Huffman code lengths to makedecodetable in ext/CHMLib/lzx.c. In the long-code branch, the function writes new internal nodes through nextsymbol before validating that the canonical...

CVE-2026-55586

SumatraPDF 3.6.1 and earlier (Windows) contains a heap out-of-bounds write in the vendored CHMLib LZX decompressor. A crafted CHM file can supply malformed Huffman code lengths to make_decode_table in ext/CHMLib/lzx.c. In the long-code branch, internal nodes are written via next_symbol before val...

CVE-2026-55586: Improper Restriction of Operations within the Bounds of a Memory Buffer

SumatraPDF is a multi-format reader for Windows. In 3.6.1 and earlier, a crafted CHM file can supply malformed LZX Huffman code lengths to makedecodetable in ext/CHMLib/lzx.c. In the long-code branch, the function writes new internal nodes through nextsymbol before validating that the canonical...

PT-2026-79059

Name of the Vulnerable Software and Affected Versions SumatraPDF versions prior to 3.6.2 Description A crafted CHM file can provide malformed LZX Huffman code lengths to the make decode table function in ext/CHMLib/lzx.c. In the long-code branch, the function writes new internal nodes via next...

Unity Linux 20.1060e / 20.1070e Security Update: clamav (UTSA-2026-017366)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-017366 advisory. On April 20, 2022, the following vulnerability in the ClamAV scanning library versions 0.103.5 and earlier and 0.104.2 and earlier was disclosed: A vulnerability in...

SUSE CVE-2026-25635

calibre is an e-book manager. Prior to 9.2.0, Calibre's CHM reader contains a path traversal vulnerability that allows arbitrary file writes anywhere the user has write permissions. On Windows haven't tested on other OS's, this can lead to Remote Code Execution by writing a payload to the Startup...

CVE-2026-25635

A flaw was found in Calibre's CHM reader. This path traversal vulnerability allows an attacker to write arbitrary files to locations where the user has write permissions. On Windows systems, this could lead to remote code execution by placing a malicious file in the Startup folder, which would th...

DEBIAN-CVE-2026-25635

calibre is an e-book manager. Prior to 9.2.0, Calibre's CHM reader contains a path traversal vulnerability that allows arbitrary file writes anywhere the user has write permissions. On Windows haven't tested on other OS's, this can lead to Remote Code Execution by writing a payload to the Startup...

CVE-2026-25635

calibre is an e-book manager. Prior to 9.2.0, Calibre's CHM reader contains a path traversal vulnerability that allows arbitrary file writes anywhere the user has write permissions. On Windows haven't tested on other OS's, this can lead to Remote Code Execution by writing a payload to the Startup...

UBUNTU-CVE-2026-25635

calibre is an e-book manager. Prior to 9.2.0, Calibre's CHM reader contains a path traversal vulnerability that allows arbitrary file writes anywhere the user has write permissions. On Windows haven't tested on other OS's, this can lead to Remote Code Execution by writing a payload to the Startup...