Read the docs
TI-2026-69817 Aliases CVE-2026-107737

Out-of-bounds object lookup in SumatraPDF CHM its:// handling

Priority MEDIUM 59CWE-129Published · Updated

Key facts

Attack vector
Local
Privileges required
None
User interaction
Passive
Attack complexity
Low
Attack requirements
Present
Impact type
Denial of service
Confidentiality · integrity · availability
None · None · High
Fix status
No fix listed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-129 and the CVSS impact.

Summary

SumatraPDF 3.6.1 and earlier, and pre-release 3.7.0.20369 when WebView2 is absent or cannot initialize, are affected. The ParseProtoUrl() function accepts the signed host component of an its:// URL, and FindHtmlWindowById() uses it directly as an array index without checking the range (CWE-129). An attacker needs a user to open a crafted CHM file through the IE fallback backend, which can cause an out-of-bounds read and process termination.

Written with Claude Haiku 5.5 from the sources below · 2026-10-29

Description from the CNA

SumatraPDF is a multi-format reader for Windows. In 3.6.1 and earlier, and in pre-release 3.7.0.20369 when WebView2 is absent or cannot initialize, ParseProtoUrl() accepts the signed host component of an its:// URL and FindHtmlWindowById() uses it directly as an index into gHtmlWindows. Opening a crafted CHM through the IE fallback backend with a negative or otherwise out-of-range window identifier can cause an out-of-bounds pointer read followed by an invalid object callback dereference and process termination. No fixed version is available as of this review.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00182 7th percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
sumatrapdfreadersumatrapdfup to 3.6.1—No fix listedCNA
  • sumatrapdf Vendorsumatrapdfreader Affected up to 3.6.1 Fixed in — No fix listed CNA

CPE names Threatist (inferred) · 1

Inferred from how NVD named this product before; not given by a source.

CPEVersionsRoleVendor
cpe:2.3:a:sumatrapdfreader:sumatrapdf:*:*:*:*:*:*:*:*——sumatrapdfreader
  • cpe:2.3:a:sumatrapdfreader:sumatrapdf:*:*:*:*:*:*:*:* Versions — — ·sumatrapdfreader

Remediation

The sources list no fixed version for SumatraPDF.

Written with Claude Haiku 5.5 from the sources below · 2026-10-29

Timeline

  1. 2026-10-09 Threatist record created from CVE-2026-107737
  2. 2026-10-10 Priority changed: MEDIUM → LOW
  3. 2026-10-13 CISA SSVC decision points changed
  4. 2026-10-13 Priority changed: LOW → MEDIUM

References

Other 2

  • TI-2026-18936 SumatraPDF has an Untrusted Search Path in sumatrapdf/src/AppTools.cpp CVSS 3.1HIGH 8.6
  • TI-2025-35489 A null pointer dereference vulnerability was discovered in SumatraPDF 3.5.2 during the… CVSS 3.1HIGH 7.3
  • TI-2012-04514 SumatraPDF 2.1.1/MuPDF 1.0 allows remote attackers to cause an Integer Overflow in the… CVSS 3.1HIGH 7.8
  • TI-2026-69819 Argument injection in SumatraPDF selection translation on Windows CVSS 4.0HIGH 7.1
  • TI-2026-69814 SumatraPDF: SyncTeX Argument Injection in Inverse Search Enables Arbitrary Command Execution via External Editors CVSS 4.0HIGH 7.1
  • TI-2026-69813 Null pointer dereference in SumatraPDF CmdExec crashes the reader CVSS 4.0MEDIUM 6.8
See all 26 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences