Description
SumatraPDF 3.6.1 contains an integer overflow vulnerability in EngineMupdf::BuildPageLabelRec() when parsing PDF PageLabels /Nums entries.
Published: 2026-09-24
Score: 7.5 High
EPSS: < 1% Very Low
KEV: No
Impact: Denial of Service
Action: Update immediately
AI Analysis

Impact

SumatraPDF version 3.6.1 contains an integer overflow in the EngineMupdf::BuildPageLabelRec() function when processing PDF PageLabels /Nums entries. The overflow occurs during calculation of array indices for labels, potentially allowing a crafted PDF file to cause a crash of the viewer.

Affected Systems

SumatraPDF 3.6.1 is the only product explicitly affected. No other vendor or version information is provided.

Risk and Exploitability

The CVSS score is 7.5, EPSS is < 1%, and the vulnerability is not listed in KEV. Based on the description, the likely attack vector is to supply a malicious PDF file to SumatraPDF, causing the integer overflow during parsing of the PageLabels /Nums entries. While a public exploit is not documented, integer overflow bugs of this type are generally considered high risk. Administrators should treat this as a high severity issue pending an official patch.

Generated by OpenCVE AI on September 26, 2026 at 05:49 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Upgrade to the newest SumatraPDF release that contains the fix
  • Restrict the application from opening PDFs from untrusted sources until the vendor releases a patch
  • Monitor vendor advisories for updates and apply any available patches as soon as they are released

Generated by OpenCVE AI on September 26, 2026 at 05:49 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Fri, 25 Sep 2026 19:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Fri, 25 Sep 2026 18:30:00 +0000

Type Values Removed Values Added
Weaknesses CWE-190
Metrics cvssV3_1

{'score': 7.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H'}

Fri, 25 Sep 2026 04:15:00 +0000

Type Values Removed Values Added
First Time appeared Sumatrapdfreader
Sumatrapdfreader sumatrapdf
Vendors & Products Sumatrapdfreader
Sumatrapdfreader sumatrapdf

Thu, 24 Sep 2026 15:30:00 +0000

Type Values Removed Values Added
Description SumatraPDF 3.6.1 contains an integer overflow vulnerability in EngineMupdf::BuildPageLabelRec() when parsing PDF PageLabels /Nums entries.
References

Subscriptions

Sumatrapdfreader Sumatrapdf
cve-icon MITRE

Status: PUBLISHED

Assigner: mitre

Published:

Updated: 2026-09-25T18:05:53.532Z

Reserved: 2026-09-10T00:00:00.000Z

Link: CVE-2026-88361

cve-icon Vulnrichment

Updated: 2026-09-25T18:05:24.787Z

cve-icon NVD

Status : Awaiting Analysis

Published: 2026-09-24T16:17:13.217

Modified: 2026-09-25T18:17:31.423

Link: CVE-2026-88361

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-09-26T06:00:06Z

Weaknesses
  • CWE-190

    Integer Overflow or Wraparound