TI-2026-69810 Aliases CVE-2026-107730

Integer overflow in SumatraPDF LIT header parsing crashes the app

LOW 24CWE-190Published 2026-10-08 · Updated 2026-10-09

Key facts

Attack vector: Local
Privileges required: None
User interaction: Required
Attack complexity: Low
Impact type: Denial of service
Confidentiality · integrity · availability: None · None · High
Fix status: No fix listed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-190 and the CVSS impact.

Summary

SumatraPDF up to and including 3.7.0.22298 is affected. A signed 32 bit integer overflow in LIT header parsing (CWE-190) produces a negative section offset that is used without validation. A local user who opens a crafted LIT file causes an invalid memory read and deterministic application termination. The sources do not show code execution, information disclosure or integrity impact.

Written with Claude Haiku 5.5 from the sources below · 2026-10-29

Description from the CNA

SumatraPDF is a multi-format reader for Windows. In 3.7.0.22298, LitParseHeader() in src/LitDoc.cpp computes the attacker-controlled hdrLen + nPieces * 16 section offset using signed 32-bit arithmetic without validating the complete result. When the component values make that aggregate calculation overflow to a negative value, pointer construction reaches an invalid read in LitU32(), causing deterministic application termination. The supplied evidence does not demonstrate code execution, information disclosure, arbitrary read, or integrity impact. No fixed version is available as of this review.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV

EPSS 0.00122 1st percentileScored 2026-11-07

Fix No fix listed No fixed version in the sources yet

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: None
Automatable: No
Technical impact: Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
sumatrapdfreader	sumatrapdf	up to 3.7.0.22298	—	No fix listed	CNA

sumatrapdf Vendorsumatrapdfreader Affected up to 3.7.0.22298 Fixed in — No fix listed CNA

CPE names Threatist (inferred) · 1

Inferred from how NVD named this product before; not given by a source.

CPE	Versions	Role	Vendor
cpe:2.3:a:sumatrapdfreader:sumatrapdf::::::::	—	—	sumatrapdfreader

cpe:2.3:a:sumatrapdfreader:sumatrapdf:*:*:*:*:*:*:*:* Versions — — ·sumatrapdfreader

Remediation

The sources list no fixed version as of this review.

Written with Claude Haiku 5.5 from the sources below · 2026-10-29

Timeline

2026-10-09 Threatist record created from CVE-2026-107730
2026-10-10 CISA SSVC decision points changed
2026-10-10 Priority changed: MEDIUM → LOW

References

Other 2

TI-2026-18936 SumatraPDF has an Untrusted Search Path in sumatrapdf/src/AppTools.cpp CVSS 3.1HIGH 8.6
TI-2025-35489 A null pointer dereference vulnerability was discovered in SumatraPDF 3.5.2 during the… CVSS 3.1HIGH 7.3
TI-2012-04514 SumatraPDF 2.1.1/MuPDF 1.0 allows remote attackers to cause an Integer Overflow in the… CVSS 3.1HIGH 7.8
TI-2026-69819 Argument injection in SumatraPDF selection translation on Windows CVSS 4.0HIGH 7.1
TI-2026-69814 SumatraPDF: SyncTeX Argument Injection in Inverse Search Enables Arbitrary Command Execution via External Editors CVSS 4.0HIGH 7.1
TI-2026-69813 Null pointer dereference in SumatraPDF CmdExec crashes the reader CVSS 4.0MEDIUM 6.8

See all 26 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences