CVE-2026-107737: Improper Validation of Array Index

SumatraPDF is a multi-format reader for Windows. In 3.6.1 and earlier, and in pre-release 3.7.0.20369 when WebView2 is absent or cannot initialize, ParseProtoUrl accepts the signed host component of an its:// URL and FindHtmlWindowById uses it directly as an index into gHtmlWindows. Opening a...

CVE-2026-107735: Not Failing Securely

SumatraPDF is a multi-format reader for Windows. In 3.6.1 and earlier, InitializePolicies starts the sumatrapdfrestrict.ini path with gPolicyRestrictions set to Perm::All and only ORs permission bits, so the INI file never revokes permissions. Deploying SumatraPDF with this INI file, including a...

CVE-2026-107732: Improper Control of Generation of Code

SumatraPDF is a multi-format reader for Windows. In 3.6.1 and earlier, untrusted document paths and PDF link targets are interpolated into notification text that ParseTip interprets as trusted tip markup. When a user clicks an injected link, ExecuteTipLink dispatches its CmdExec command and can...

CVE-2026-107731: Out-of-bounds Read

SumatraPDF is a multi-format reader for Windows. In 3.7.0.22298, four independently reachable range-validation variants in src/LitDoc.cpp allow file-controlled offsets and sizes to overflow, narrow to negative values, or wrap before incomplete bounds checks. The affected calculations include...

PT-2026-108305

Name of the Vulnerable Software and Affected Versions SumatraPDF versions 3.6.1 and earlier SumatraPDF version 3.7.0.20369 Description When WebView2 is absent or fails to initialize, the ParseProtoUrl function accepts the signed host component of an its:// URL, which is then used by the...

PT-2026-108306

Name of the Vulnerable Software and Affected Versions SumatraPDF versions prior to 3.6.2 Description The ChmFile::GetCharZ function narrows file-controlled unsigned string offsets from /WINDOWS and /IVB to signed integers without performing a lower-bound check. If an offset becomes negative, the...

PT-2026-108291

Name of the Vulnerable Software and Affected Versions SumatraPDF version 3.7.0.22298 Description An issue exists in the LitParseHeader function within src/LitDoc.cpp where the calculation of the section offset using hdrLen and nPieces is performed with signed 32-bit arithmetic without proper...

PT-2026-108290

Name of the Vulnerable Software and Affected Versions SumatraPDF version 3.7.0.22298 Description In the src/MobiDoc.cpp file, the untrusted unsigned mobiHdr.hdrLen field is narrowed to a signed integer during validation. This allows values exceeding INT MAX to be treated as negative, bypassing th...

PT-2026-108292

Name of the Vulnerable Software and Affected Versions SumatraPDF version 3.7.0.22298 Description Four range-validation variants in src/LitDoc.cpp allow file-controlled offsets and sizes to overflow, narrow to negative values, or wrap before incomplete bounds checks. The affected calculations...

PT-2026-108304

Name of the Vulnerable Software and Affected Versions SumatraPDF versions prior to 3.6.2 Description The MaybeFlipBitmap function uses GetPropertyItem to read the PropertyTagOrientation size via GDI+ into a fixed 64-byte buffer on the stack. An attacker can trigger a stack-based buffer overflow b...

PT-2026-108295

Name of the Vulnerable Software and Affected Versions SumatraPDF versions prior to 3.5.3 Description An issue exists where an attacker-controlled SyncTeX source filename is substituted for the %f placeholder in an external editor command line without safe Windows argument quoting. This command li...

PT-2026-108294

Name of the Vulnerable Software and Affected Versions SumatraPDF versions prior to 3.6.2 Description The FrameOnCommand function handles CmdExec by passing a null current-tab pointer to RunWithExe, which then dereferences WindowTab::filePath. A local process within the same interactive Windows...

PT-2026-108303

Name of the Vulnerable Software and Affected Versions SumatraPDF versions prior to 3.6.2 Description The InitializePolicies function incorrectly handles the sumatrapdfrestrict.ini path by initializing gPolicyRestrictions to Perm::All and only using OR operations for permission bits. This logic...

CVE-2026-107730: Integer Overflow or Wraparound

SumatraPDF is a multi-format reader for Windows. In 3.7.0.22298, LitParseHeader in src/LitDoc.cpp computes the attacker-controlled hdrLen + nPieces 16 section offset using signed 32-bit arithmetic without validating the complete result. When the component values make that aggregate calculation...

SumatraPDF Heap Buffer Overflow DoS

The vulnerability of the MobiDoc::ParseHeader function in the src/MobiDoc.cpp file of the PDF, EPUB, MOBI, FB2, CHM, XPS, and DjVu viewing software SumatraPDF lies in the reading of data beyond the allowed range of memory. Exploiting this vulnerability can allow an attacker to cause a service...

CVE-2026-26054

SumatraPDF is a multi-format reader for Windows. Prior to 3.6, the MobiDoc::ParseHeader function in src/MobiDoc.cpp validates a record using kMobiHeaderMinLen but DecodeMobiDocHeader constructs a decoder sized for kMobiHeaderLen without receiving the actual remaining buffer length. A malformed MO...

CVE-2026-26054 SumatraPDF: Heap out-of-bounds read in MOBI header parser.

SumatraPDF is a multi-format reader for Windows. Prior to 3.6, the MobiDoc::ParseHeader function in src/MobiDoc.cpp validates a record using kMobiHeaderMinLen but DecodeMobiDocHeader constructs a decoder sized for kMobiHeaderLen without receiving the actual remaining buffer length. A malformed MO...

CVE-2026-26054

SumatraPDF, a multi-format reader for Windows, is vulnerable to a heap out-of-bounds read in the MobiDoc::ParseHeader function within src/MobiDoc.cpp. The issue occurs because DecodeMobiDocHeader constructs a decoder sized for kMobiHeaderLen without verifying the actual remaining buffer length, e...

CVE-2026-26054 SumatraPDF: Heap out-of-bounds read in MOBI header parser.

SumatraPDF is a multi-format reader for Windows. Prior to 3.6, the MobiDoc::ParseHeader function in src/MobiDoc.cpp validates a record using kMobiHeaderMinLen but DecodeMobiDocHeader constructs a decoder sized for kMobiHeaderLen without receiving the actual remaining buffer length. A malformed MO...

CVE-2026-26054 SumatraPDF: Heap out-of-bounds read in MOBI header parser.

SumatraPDF is a multi-format reader for Windows. Prior to 3.6, the MobiDoc::ParseHeader function in src/MobiDoc.cpp validates a record using kMobiHeaderMinLen but DecodeMobiDocHeader constructs a decoder sized for kMobiHeaderLen without receiving the actual remaining buffer length. A malformed MO...