SumatraPDF
CVE-2026-107731
MEDIUM
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessDeliver crafted LIT file to victim
-
DeliveryVictim opens file in SumatraPDF
-
ExploitOverflowed offset/size bypasses bounds check
-
ExecutionOut-of-bounds pointer read
-
ImpactApplication crashes (denial of service)
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Bounds checking, read limits
MITRE ATT&CK
1 technique across 1 tactic: Collection The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires a user to open an attacker-crafted LIT (Microsoft Reader) file in SumatraPDF 3.7.0.22298; the malicious file must set offset/size fields (contentOffset, dirOff64+dirLen64, decoded-section offset+size, or secondary-header ranges) so they overflow, go negative, or wrap before the bounds checks in src/LitDoc.cpp. Limiting factors: the attack is local (AV:L) and strictly requires victim interaction (UI:R) to open the file - there is no remote or unauthenticated network path, no privilege needed on the target, and impact is confined to crashing the reader (availability only). Exploitation is further gated by the victim choosing to open a LIT file, an uncommon format, in this specific vulnerable build. |
| Impact | This is a moderate, not high-priority, issue and the signals are internally consistent. The provided CVSS 3.1 vector (AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H, base 5.5) correctly models a local, user-interaction-dependent flaw whose only impact is availability - the description explicitly limits consequences to 'invalid pointer reads and deterministic application termination' (a crash), with 'No broader impact claimed.' The CWE-125 (out-of-bounds read) classification and the 'Information Disclosure' tag suggest possible memory disclosure, but this CONFLICTS with the advisory and the vector's C:N: no confidentiality impact is substantiated, so treat information disclosure as unverified. No EPSS score was provided, there is no CISA KEV listing, and no public exploit was supplied (the referenced GitHub commit is the vendor patch, not exploit code). Because exploitation requires a victim to locally open a crafted LIT file in a desktop reader, real-world risk is limited to targeted social-engineering-style delivery rather than mass or remote exploitation. Net: a legitimate crash/DoS bug worth patching when a fix ships, but not an emergency. |
| Exploit ScenarioDerived | An attacker crafts a malicious LIT (Microsoft Reader eBook) file with manipulated offset/size fields that trigger one of the four range-validation flaws in LitDoc.cpp, then delivers it via email, download, or a shared drive. When the victim opens the file in SumatraPDF, an out-of-bounds read occurs and the application deterministically terminates. No public exploit code was identified; the only published artifact is the vendor source-code patch. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 08, 2026
Application termination in SumatraPDF 3.7.0.22298 is reachable when a user opens an attacker-crafted LIT (Microsoft Reader) file, because file-controlled offset and size fields in src/LitDoc.cpp overflow, narrow to negative values, or wrap before incomplete bounds checks, yielding invalid pointer reads and a deterministic crash. The attack path is local and requires the victim to open the malicious document (AV:L/AC:L/PR:N/UI:R, availability-only impact with no confidentiality or integrity loss), and exploitation is further gated by the victim using this specific build and handling the uncommon LIT format. No public exploit code and no confirmed active exploitation were identified at time of analysis, and no EPSS data was supplied, so this remains a moderate-severity denial-of-service condition rather than a high-priority memory-corruption or code-execution threat.
RemediationAI
No vendor-released patched version was identified at time of analysis, so there is no fixed build to upgrade to; the most direct fix is the upstream commit 5d43b8cf9c45335ffd47e616bfa27648f17d0b63 in src/LitDoc.cpp, which corrects the overflowing range checks (see the advisory at https://github.com/sumatrapdfreader/sumatrapdf/security/advisories/GHSA-753j-hx3p-xm9g). Users who build SumatraPDF from source should apply that commit or build from a revision after it; users of the official 3.7.0.22298 binary must wait for a release that incorporates it. Because the defect is triggered purely by parsing a malicious LIT file, the practical compensating controls are input-side: block or quarantine .lit files at mail gateways, download filters, and file-transfer endpoints, and train users not to open LIT e-books from untrusted sources - the trade-off is that legitimate Microsoft Reader content becomes inaccessible through those channels. There is no configuration switch to disable LIT parsing in SumatraPDF, and the affected arithmetic runs before rendering, so toggling scripting, JavaScript, or rendering options provides no protection. Where LIT processing must continue, run SumatraPDF inside a low-privilege account, AppContainer, or Windows Sandbox so that the resulting crash is contained and cannot affect other documents or processes; the trade-off is reduced file-system and shell-integration access for the reader. Since the assessed impact is availability only and no code-execution primitive is demonstrated, priority should be placed on preventing delivery of crafted .lit files to vulnerable builds rather than on emergency patching.
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
CVE-2026-107731 is an out-of-bounds read (CWE-125) in the LIT document parser of SumatraPDF, specifically in src/LitDoc.cpp. LIT is Microsoft Reader's container format: a header section holds a directory of section entries (offset/size pairs), a content offset, and secondary-header ranges, while compressed sections are decoded with LZX using a reset table that indexes decompression state. The root cause is 32-bit signed arithmetic on values taken directly from the untrusted file: contentOffset derived from the file is cast to int without validating against the data length; the directory expression dirOff64 + dirLen64 can wrap before being compared to the buffer length; the combined decoded-section offset + size check can overflow; the LZX reset-table entry offset (LitU32(resetTable, 12) + 8) can be pushed past the buffer; and the atom loop check pos + size > len(data) can itself wrap. The upstream commit 5d43b8cf9c45335ffd47e616bfa27648f17d0b63 rewrites these as subtraction-based comparisons that cannot overflow (pos <= len(sec) - 8, dirLen64 > len(d) - dirOff64, e->size > len(d) - off), widens the LZX control-size computation to i64 before narrowing, and explicitly rejects negative or out-of-range offsets and sizes. CWE-125 is consistent with the assessed impact: the malformed arithmetic produces pointer reads outside the intended buffer and the process terminates, with no memory write or code-execution primitive claimed. The supplied CPE cpe:2.3:a:sumatrapdfreader:sumatrapdf:*:*:*:*:*:*:*:* flags the product across versions, but the advisory and reproduction evidence pin the defect to build 3.7.0.22298.
Know when Sumatrapdf gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Opening a local crafted file gives AV:L/UI:R with no privileges (PR:N); the advisory limits impact to a deterministic crash, so C:N/I:N but A:H.
Primary rating from Vendor (GitHub_M).
CVSS VectorVendor: GitHub_M
DescriptionCVE.org
SumatraPDF is a multi-format reader for Windows. In 3.7.0.22298, four independently reachable range-validation variants in src/LitDoc.cpp allow file-controlled offsets and sizes to overflow, narrow to negative values, or wrap before incomplete bounds checks. The affected calculations include contentOffset, the directory expression dirOff64 + dirLen64, and the decoded-section offset + size, along with secondary-header range handling. Opening a crafted LIT file that reaches one of these variants can cause invalid pointer reads and deterministic application termination. No broader impact is claimed beyond the advisory-supported conditions. No fixed version is available as of this review.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
GitHub
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
Affected Products (CPE)CVE.org
More in Sumatrapdf
View allSumatraPDF 3.5.2 and earlier on Windows contains an untrusted search path vulnerability in the Advanced Options feature
SumatraPDF 3.5.2 and earlier on Windows allows arbitrary code execution when a user opens a PDF and selects "Show in fol
SumatraPDF versions 3.5.0 through 3.5.2 fail to validate TLS certificates during software updates and execute installers
Heap-based buffer overflow in SumatraPDF before 2.1 allows remote attackers to execute arbitrary code via a crafted PDF
Heap-based buffer overflow in SumatraPDF before 2.1 allows remote attackers to execute arbitrary code via a crafted PDF
SumatraPDF versions 3.5.2 and earlier are vulnerable to a heap buffer over-read in the MOBI file parser due to incomplet
SumatraPDF on Windows is vulnerable to a denial-of-service attack through a maliciously crafted Mobi file that triggers
A buffer overflow in SumatraPDF Reader v3.4.6 allows attackers to cause a Denial of Service (DoS) via a crafted text fil
Local code execution in SumatraPDF 3.6.1 and earlier on Windows is possible when a user opens an attacker-supplied docum
Parsing a malformed PDF in SumatraPDF 3.6.1 can crash the reader through a signed integer overflow in the PageLabels han
Command-line argument injection in SumatraPDF 3.5.2 and earlier lets an attacker-controlled SyncTeX source filename esca
Argument injection in the AI translation feature of SumatraPDF 3.6.1 and earlier allows text placed in a document select
Exploit-DB