CVE-2026-107738

SumatraPDF is a multi-format reader for Windows. In 3.6.1 and earlier, ChmFile::GetCharZ narrows file-controlled unsigned string offsets from /WINDOWS and /IVB to signed integers without a lower-bound check. An offset that becomes negative can make the function read before the /STRINGS buffer,...

CVE-2026-107738

SumatraPDF is a multi-format reader for Windows. In 3.6.1 and earlier, ChmFile::GetCharZ narrows file-controlled unsigned string offsets from /WINDOWS and /IVB to signed integers without a lower-bound check. An offset that becomes negative can make the function read before the /STRINGS buffer,...

CVE-2026-107738 SumatraPDF: Untrusted binary record offset used without lower-bound validation

SumatraPDF is a multi-format reader for Windows. In 3.6.1 and earlier, ChmFile::GetCharZ narrows file-controlled unsigned string offsets from /WINDOWS and /IVB to signed integers without a lower-bound check. An offset that becomes negative can make the function read before the /STRINGS buffer,...

CVE-2026-107738 SumatraPDF: Untrusted binary record offset used without lower-bound validation

SumatraPDF is a multi-format reader for Windows. In 3.6.1 and earlier, ChmFile::GetCharZ narrows file-controlled unsigned string offsets from /WINDOWS and /IVB to signed integers without a lower-bound check. An offset that becomes negative can make the function read before the /STRINGS buffer,...

CVE-2026-107738 SumatraPDF: Untrusted binary record offset used without lower-bound validation

SumatraPDF is a multi-format reader for Windows. In 3.6.1 and earlier, ChmFile::GetCharZ narrows file-controlled unsigned string offsets from /WINDOWS and /IVB to signed integers without a lower-bound check. An offset that becomes negative can make the function read before the /STRINGS buffer,...

CVE-2026-107738

SumatraPDF versions 3.6.1 and earlier on Windows are vulnerable to an out-of-bounds read. The issue resides in the ChmFile::GetCharZ() function, which narrows file-controlled unsigned string offsets from /#WINDOWS and /#IVB to signed integers without performing a lower-bound check. If an offset b...

EUVD-2026-95413

SumatraPDF is a multi-format reader for Windows. In 3.6.1 and earlier, ChmFile::GetCharZ narrows file-controlled unsigned string offsets from /WINDOWS and /IVB to signed integers without a lower-bound check. An offset that becomes negative can make the function read before the /STRINGS buffer,...

PT-2026-108306

Name of the Vulnerable Software and Affected Versions SumatraPDF versions prior to 3.6.2 Description The ChmFile::GetCharZ function narrows file-controlled unsigned string offsets from /WINDOWS and /IVB to signed integers without performing a lower-bound check. If an offset becomes negative, the...

CVE-2026-107738: Out-of-bounds Read

SumatraPDF is a multi-format reader for Windows. In 3.6.1 and earlier, ChmFile::GetCharZ narrows file-controlled unsigned string offsets from /WINDOWS and /IVB to signed integers without a lower-bound check. An offset that becomes negative can make the function read before the /STRINGS buffer,...