The vulnerability originates when SumatraPDF processes a CHM file that supplies malformed LZX Huffman code lengths. During the long‑code branch of LZXdecompress, the function writes new internal nodes through next_symbol before validating that the canonical Huffman table has overflowed, allowing a write past the end of the 104‑entry PRETREE table into adjacent heap state within the LZXstate structure. This results in heap memory corruption in the parser process; arbitrary code execution has not been demonstrated but the corruption could be leveraged to subvert program control flow.

SumatraPDF reader for Windows, versions 3.6.1 and earlier. The flaw is triggered by loading a crafted .chm document using the chm_open, chm_retrieve_object, LZXdecompress, and BUILD_TABLE workflow. Users who open such files with the vulnerable reader are affected.

The CVSS score of 6.6 indicates moderate severity. The EPSS score is not available and the issue is not listed in CISA's KEV catalog. Exploitation requires a malicious CHM file and local execution of SumatraPDF; no public exploit has been reported. The risk is noteworthy for environments that allow untrusted CHM content, as heap corruption could lead to unpredictable behavior or potential compromise if an exploit is crafted.