SumatraPDF 3.6.1 and earlier allow an unsigned offset derived from a chm file to be converted to a signed integer without checking that the result is non‑negative. When the offset becomes negative, the reading routine accesses memory before the intended buffer, causing the program to terminate deterministically. This flaw does not provide code execution or privilege escalation; it only yields a crash. The weakness is a classic buffer underread (CWE-125).

The vulnerability affects SumatraPDF (sumatrapdfreader:sumatrapdf) version 3.6.1 and earlier when opening chm files. No newer versions have been released at the time of this analysis.

The CVSS score of 6.8 indicates a moderate impact, and no exploit probability is available from EPSS. The flaw is not listed in CISA KEV, suggesting low public exploitation so far. A local attacker or anyone who can supply a malicious chm file can trigger a deterministic crash, interrupting user workflows but not compromising system data or security. The attack vector is inferred to be local, requiring the execution of the vulnerable application with a crafted file.