A stack buffer overflow occurs in SumatraPDF when it processes EXIF Orientation data in TIFF files. The function %sMaybeFlipBitmap%% asks GDI+ to read the PropertyTagOrientation size through GetPropertyItem() while only allocating a fixed 64‑byte buffer on the stack. If a crafted TIFF contains enough Orientation entries, attacker‑selected bytes can overwrite stack‑control data; however the program terminates through the stack cookie check, preventing immediate exploitation. The result is a crash of the application, leading to a denial of service for the affected user. The flaw is a classic stack buffer overflow (CWE‑121) and does not provide remote code execution or privilege escalation.

The vulnerable code exists in SumatraPDF versions 3.6.1 and earlier, available for Windows. Any instance of the SumatraPDF reader that loads user‑supplied TIFF files from untrusted sources is potentially affected. No specific patch is available as of the last review; the issue is acknowledged by the vendor on GitHub with a commit reference but no updated binary is released.

The CVSS score of 6.8 indicates a moderate severity. EPSS data is unavailable, but the flaw is not listed in CISA KEV. The likely attack vector is local; an attacker must supply a malicious TIFF file to a vulnerable user. Because the bug triggers a stack cookie abort, exploitation does not lead to code execution, and the impact is limited to a crash. Consequently, the risk is considered moderate, but the vulnerability remains relevant for environments where uncontrolled file viewing poses a threat.