SumatraPDF
CVE-2026-107736
MEDIUM
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessDeliver crafted TIFF to victim
-
ExploitVictim opens file in SumatraPDF
-
ExecutionOversized EXIF Orientation overflows 64-byte stack buffer
-
ImpactStack cookie aborts process (crash/DoS)
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Stack buffer bounds checking
MITRE ATT&CK
1 technique across 1 tactic: Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires a victim to open a crafted image file (a TIFF carrying an oversized EXIF PropertyTagOrientation, e.g. many Orientation values) so that the property size exceeds the fixed 64-byte stack buffer passed to GetPropertyItem() in MaybeFlipBitmap(). This affects default configurations of SumatraPDF 3.6.1 and earlier with no special feature or setting needed. Limiting factors: the vector is local and depends on user interaction (the user must actually open the malicious file), there is no network-remote trigger, and the realistic outcome is a process crash because the stack cookie check terminates tested builds before any code execution - so impact is availability only, not confidentiality or integrity. |
| Impact | This is a medium-severity issue (CVSS 4.0 base 6.8) whose real-world priority is modest. The provided CVSS 4.0 vector (AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H) shows a local, low-complexity, unauthenticated vector that requires passive user interaction (opening a file) and produces only an availability impact - no confidentiality or integrity loss. No EPSS score was supplied, the CVE is not in CISA KEV, and no public exploit code is referenced, so there is no exploitation-probability signal pointing to active or imminent abuse. The most important nuance is a potential-vs-actual-impact tension: CWE-121 (stack-based buffer overflow) and the phrase 'overwrite stack control data' superficially suggest code execution, but the advisory and description explicitly state that tested builds terminate via the stack cookie check and that 'no broader impact is claimed beyond the advisory-supported conditions.' The input vector correctly reflects this by scoring VC:N/VI:N and VA:H (crash/denial of service), not integrity/confidentiality compromise. Net assessment: a real but non-urgent bug - locally/socially triggered DoS of the PDF reader, mitigated in practice by stack cookies, with no evidence of exploitation and no patch yet available. |
| Exploit ScenarioDerived | An attacker crafts a malicious TIFF (or TIFF-embedded) file containing a large number of EXIF Orientation values and delivers it to a victim via email, download, or a web link. When the victim opens the file in SumatraPDF 3.6.1 or earlier, GetPropertyItem() writes the oversized orientation property past the fixed 64-byte stack buffer in MaybeFlipBitmap(), corrupting stack control data and crashing the process when the stack cookie check fires. No public exploit code was identified; realistic impact is a reliable crash rather than demonstrated code execution. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 08, 2026
Opening a crafted TIFF file in SumatraPDF 3.6.1 and earlier can crash the application through a stack-based buffer overflow in MaybeFlipBitmap(), where GDI+ writes an attacker-controlled EXIF PropertyTagOrientation size into a fixed 64-byte stack buffer. The attack is local and requires the victim to open a malicious image (CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P, base 6.8), and successful exploitation corrupts stack control data that the compiler's stack cookie check intercepts in tested builds, terminating the process. Impact is limited to availability (no confidentiality or integrity loss is claimed), with no confirmed active exploitation (not listed in CISA KEV) and no public exploit identified at time of analysis.
RemediationAI
No vendor-released patch identified at time of analysis: the advisory states no fixed version is available, though an upstream fix exists as a commit (https://github.com/sumatrapdfreader/sumatrapdf/commit/6fe2e0239d8ef3466174ac92f3f56e967ce1a4a7, resolving advisory GHSA-px68-7vwv-mxpr) that rejects oversized property sizes and malformed properties before calling GDI+, so organizations tracking the repository can build from that commit, but a released patched version is not independently confirmed. Because exploitation requires only that a user open a malicious TIFF, the most effective compensating controls are to avoid opening TIFF/EXIF-bearing images from untrusted sources and to strip or neutralize untrusted image handling - for example, disable or remove the .tif/.tiff file association so such files no longer open in SumatraPDF (side effect: legitimate TIFF viewing is lost), or route image inspection through a different, hardened viewer or a converted/rendered copy. Running SumatraPDF inside a restricted sandbox (low-integrity token, AppContainer, or a Windows Sandbox/VM) meaningfully contains the crash and blocks any escalation beyond the compromised process, at the cost of extra friction and potential loss of shell integration. Keeping Windows Exploit Protection defaults, including stack cookie (/GS) and DEP/ASLR, in place limits the overflow to a denial-of-service crash, and users should monitor the vendor advisory at https://github.com/sumatrapdfreader/sumatrapdf/security/advisories/GHSA-px68-7vwv-mxpr for a patched release with an exact fix version before deploying it broadly.
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
SumatraPDF's Windows image decoding path (src/ImageReader_win.cpp) uses WIC to decode images and then calls MaybeFlipBitmap() to correct orientation. That function requests the EXIF PropertyTagOrientation property from GDI+ via GetPropertyItem(), passing a fixed 64-byte stack buffer, but sizes the request from the image-supplied property size (propSize). A TIFF crafted with an oversized Orientation property (for example, many Orientation values) therefore makes GDI+ write more bytes than the buffer holds, a classic CWE-121 stack-based buffer overflow. The vulnerable code path previously only logged the mismatch with a diagnostic ReportIf(propSize > dimof(buf)) rather than rejecting it; the upstream commit additionally guards against a null/short property value before reading the first u16. Because the overwritten region includes stack control data protected by the stack cookie (/GS), tested builds crash rather than yielding reliable control-flow hijack, which is consistent with the assessed availability-only impact. The affected CPE, cpe:2.3:a:sumatrapdfreader:sumatrapdf with a wildcard version, covers all SumatraPDF releases through 3.6.1 on Windows; no other product family is implicated.
Know when Sumatrapdf gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
File must be opened locally so AV:L and UI:R; no authentication so PR:N; stack cookie limits impact to a crash, giving C:N/I:N and A:H.
Primary rating from Vendor (GitHub_M).
CVSS VectorVendor: GitHub_M
DescriptionCVE.org
SumatraPDF is a multi-format reader for Windows. In 3.6.1 and earlier, MaybeFlipBitmap() asks GDI+ to read the attacker-controlled PropertyTagOrientation size through GetPropertyItem() while supplying only a fixed 64-byte buf on the stack. Opening a crafted TIFF with enough EXIF Orientation values can cause attacker-selected bytes to overwrite stack control data, while tested builds terminate through the stack cookie check. No broader impact is claimed beyond the advisory-supported conditions. No fixed version is available as of this review.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
GitHub
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.
A stack-based buffer overflow occurs when a program writes more data to a buffer located on the stack than it was allocated to hold.
Affected Products (CPE)CVE.org
More in Sumatrapdf
View allSumatraPDF 3.5.2 and earlier on Windows contains an untrusted search path vulnerability in the Advanced Options feature
SumatraPDF 3.5.2 and earlier on Windows allows arbitrary code execution when a user opens a PDF and selects "Show in fol
SumatraPDF versions 3.5.0 through 3.5.2 fail to validate TLS certificates during software updates and execute installers
Heap-based buffer overflow in SumatraPDF before 2.1 allows remote attackers to execute arbitrary code via a crafted PDF
Heap-based buffer overflow in SumatraPDF before 2.1 allows remote attackers to execute arbitrary code via a crafted PDF
SumatraPDF versions 3.5.2 and earlier are vulnerable to a heap buffer over-read in the MOBI file parser due to incomplet
SumatraPDF on Windows is vulnerable to a denial-of-service attack through a maliciously crafted Mobi file that triggers
A buffer overflow in SumatraPDF Reader v3.4.6 allows attackers to cause a Denial of Service (DoS) via a crafted text fil
Local code execution in SumatraPDF 3.6.1 and earlier on Windows is possible when a user opens an attacker-supplied docum
Parsing a malformed PDF in SumatraPDF 3.6.1 can crash the reader through a signed integer overflow in the PageLabels han
Command-line argument injection in SumatraPDF 3.5.2 and earlier lets an attacker-controlled SyncTeX source filename esca
Argument injection in the AI translation feature of SumatraPDF 3.6.1 and earlier allows text placed in a document select
Exploit-DB