Description
SumatraPDF is a multi-format reader for Windows. In 3.6.1 and earlier, and in pre-release 3.7.0.20369 when WebView2 is absent or cannot initialize, ParseProtoUrl() accepts the signed host component of an its:// URL and FindHtmlWindowById() uses it directly as an index into gHtmlWindows. Opening a crafted CHM through the IE fallback backend with a negative or otherwise out-of-range window identifier can cause an out-of-bounds pointer read followed by an invalid object callback dereference and process termination. No fixed version is available as of this review.
Published: 2026-10-08
Score: 5.7 Medium
EPSS: < 1% Very Low
KEV: No
Impact: Denial of Service via process termination
Action: Assess Impact
AI Analysis

Impact

SumatraPDF incorrectly processes signed host components of its:// URLs in CHM files, leading to an out‑of‑bounds lookup of a window index. This causes an invalid pointer read and subsequent callback dereference that crashes the viewer, resulting in a denial of service.

Affected Systems

The flaw is present in SumatraPDF 3.6.1 and earlier, as well as the pre‑release 3.7.0.20369 when the optional WebView2 component cannot initialize. The bug exploits the IE fallback backend. No patch currently fixes the issue.

Risk and Exploitability

The CVSS score of 5.7 indicates moderate severity. The EPSS score is unavailable, and the vulnerability is not listed in CISA’s KEV catalog. The most likely attack vector is a local user opening a crafted CHM file containing a malicious its:// URL, which will trigger the crash during parsing.

Generated by OpenCVE AI on October 8, 2026 at 23:21 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Ensure that SUMATRA PDF has the Microsoft Edge WebView2 Runtime installed so it can avoid the IE fallback path that triggers the bug.
  • Avoid opening untrusted or unknown CHM files that may contain malicious its:// URLs.
  • Stay updated on vendor releases and apply any future patch that addresses this vulnerability.

Generated by OpenCVE AI on October 8, 2026 at 23:21 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Tue, 13 Oct 2026 17:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Thu, 08 Oct 2026 23:30:00 +0000

Type Values Removed Values Added
First Time appeared Sumatrapdfreader
Sumatrapdfreader sumatrapdf
Vendors & Products Sumatrapdfreader
Sumatrapdfreader sumatrapdf

Thu, 08 Oct 2026 22:45:00 +0000

Type Values Removed Values Added
Description SumatraPDF is a multi-format reader for Windows. In 3.6.1 and earlier, and in pre-release 3.7.0.20369 when WebView2 is absent or cannot initialize, ParseProtoUrl() accepts the signed host component of an its:// URL and FindHtmlWindowById() uses it directly as an index into gHtmlWindows. Opening a crafted CHM through the IE fallback backend with a negative or otherwise out-of-range window identifier can cause an out-of-bounds pointer read followed by an invalid object callback dereference and process termination. No fixed version is available as of this review.
Title SumatraPDF CHM `its://` signed index causes an out-of-bounds object lookup
Weaknesses CWE-129
References
Metrics cvssV4_0

{'score': 5.7, 'vector': 'CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N'}

Subscriptions

Sumatrapdfreader Sumatrapdf
cve-icon MITRE

Status: PUBLISHED

Assigner: GitHub_M

Published:

Updated: 2026-10-13T16:28:11.204Z

Reserved: 2026-10-08T17:21:52.977Z

Link: CVE-2026-107737

cve-icon Vulnrichment

Updated: 2026-10-13T16:28:06.673Z

cve-icon NVD

Status : Deferred

Published: 2026-10-08T23:16:59.760

Modified: 2026-10-13T17:17:17.340

Link: CVE-2026-107737

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-08T23:30:12Z

Weaknesses
  • CWE-129

    Improper Validation of Array Index