SumatraPDF CVE-2026-107737

Exploitation requires the victim to open an attacker-crafted CHM file in SumatraPDF, AND the vulnerable IE fallback backend must be in use - which only happens when Microsoft WebView2 is absent or cannot initialize on the host. The crafted CHM must embed an its:// URL whose signed host component encodes a negative or out-of-range window identifier that FindHtmlWindowById() uses as an index into gHtmlWindows. Limiting factors: requires user interaction (opening the file), is local-only (no remote/network trigger), and the WebView2-absent precondition is non-default on current Windows, so systems with a working WebView2 runtime are not affected via this path. No authentication is required (PR:N), but impact is limited to a crash of the SumatraPDF process.

This is a moderate-severity denial-of-service issue, not a high-priority emergency. The supplied CVSS 4.0 score of 5.7 is driven entirely by availability impact (VA:H) with no confidentiality or integrity impact (VC:N/VI:N) - the advisory explicitly describes an out-of-bounds pointer read and invalid object callback dereference ending in process termination, i.e. a crash, not code execution. Several signals lower real-world risk: the vector is local (AV:L), requires user interaction (UI:P - the victim must open a malicious file), and carries an attack requirement (AT:P) because the vulnerable IE fallback path only runs when WebView2 is absent or cannot initialize, which is non-default on current Windows installs. EPSS is not provided, KEV status is NO (no active exploitation), and no public exploit code is referenced. A fix commit is public (596c7e2) which discloses the root cause (unvalidated signed index from an its:// URL host, CWE-129), but a disclosed patch is not the same as a weaponized exploit. Note that no fixed release version exists yet - only an unreleased commit - so remediation currently requires building from source or waiting for a release. Net assessment: genuine but low-to-moderate priority, bounded by multiple exploitation preconditions and crash-only impact.

An attacker crafts a malicious CHM file whose embedded its:// URL carries a negative or out-of-range signed host value, then delivers it to a victim via email or download. When the victim opens it in SumatraPDF 3.6.1 or earlier on a system where WebView2 is unavailable, the IE fallback backend uses the attacker-controlled value as an array index into gHtmlWindows, causing an out-of-bounds read and process crash. No public exploit code is identified, though the public fix commit discloses the exact mechanism.