Read the docs
TI-2026-40125 Aliases CVE-2026-55586

SumatraPDF: Heap out-of-bounds write in vendored CHMLib LZX Huffman table construction reachable from crafted CHM files

Priority LOW 28CWE-119Published · Updated

Key facts

Attack vector
Local
Privileges required
None
User interaction
Required
Attack complexity
Low
Impact type
—
Confidentiality · integrity · availability
Low · High · Low
Fix status
No fix listed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA.

Summary

SumatraPDF is a multi-format reader for Windows. In 3.6.1 and earlier, a crafted CHM file can supply malformed LZX Huffman code lengths to make_decode_table in ext/CHMLib/lzx.c. In the long-code branch, the function writes new internal nodes through next_symbol before validating that the canonical Huffman table has overflowed. The PRETREE case can write beyond the 104-entry PRETREE_table into adjacent heap state in struct LZXstate when reached through chm_open, chm_retrieve_object, LZXdecompress, and BUILD_TABLE. This produces heap memory corruption in the parser process, while arbitrary code execution has not been demonstrated. No fixed version is available as of this review.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00174 6th percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
sumatrapdfreadersumatrapdfup to 3.6.1rel—No fix listedCNA
  • sumatrapdf Vendorsumatrapdfreader Affected up to 3.6.1rel Fixed in — No fix listed CNA

CPE names Threatist (inferred) · 1

Inferred from how NVD named this product before; not given by a source.

CPEVersionsRoleVendor
cpe:2.3:a:sumatrapdfreader:sumatrapdf:*:*:*:*:*:*:*:*——sumatrapdfreader
  • cpe:2.3:a:sumatrapdfreader:sumatrapdf:*:*:*:*:*:*:*:* Versions — — ·sumatrapdfreader

Remediation

No fixed version listed by the sources yet.

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-55586

References

Other 2

  • TI-2026-18936 SumatraPDF has an Untrusted Search Path in sumatrapdf/src/AppTools.cpp CVSS 3.1HIGH 8.6
  • TI-2025-35489 A null pointer dereference vulnerability was discovered in SumatraPDF 3.5.2 during the… CVSS 3.1HIGH 7.3
  • TI-2012-04514 SumatraPDF 2.1.1/MuPDF 1.0 allows remote attackers to cause an Integer Overflow in the… CVSS 3.1HIGH 7.8
  • TI-2026-69819 Argument injection in SumatraPDF selection translation on Windows CVSS 4.0HIGH 7.1
  • TI-2026-69814 SumatraPDF: SyncTeX Argument Injection in Inverse Search Enables Arbitrary Command Execution via External Editors CVSS 4.0HIGH 7.1
  • TI-2026-69813 Null pointer dereference in SumatraPDF CmdExec crashes the reader CVSS 4.0MEDIUM 6.8
See all 26 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences