SumatraPDF CVE-2026-107738

Requires a victim to open an attacker-crafted CHM (compiled HTML Help) file in SumatraPDF 3.6.1 or earlier; specifically the CHM must contain a /#WINDOWS or /#IVB string offset large enough that narrowing the file-controlled unsigned DWORD to a signed int yields a negative value, driving ChmFile::GetCharZ() to read before the /#STRINGS buffer. Limiting factors: exploitation is local and demands user interaction (the victim must actively open the malicious file), there is no network-remote path, and the outcome is confined to a crash - no code execution, privilege gain, or data disclosure. No authentication is required (PR:N), but delivery and user action are mandatory.

This is a medium-severity denial-of-service issue, not a high-urgency priority. The CVSS 4.0 vector (AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H, score 6.8) is internally consistent with the advisory: exploitation requires a local vector plus passive user interaction (opening a malicious file), and the only impact is availability (VA:H) - confidentiality and integrity are explicitly N. The GitHub advisory and fix commit confirm the root cause is an out-of-bounds READ before the /#STRINGS buffer caused by a file-controlled unsigned offset narrowed to a signed int, and the advisory states the sole consequence is 'deterministic application termination' with 'no broader impact claimed.' No EPSS score, CISA KEV listing, or public exploit was provided in the input, so exploitation probability cannot be quantified and there is no public exploit identified at time of analysis. Note a data conflict: the input Tags label this 'Information Disclosure,' but both the CVSS vector (VC:N) and the advisory text contradict any disclosure impact - treat the info-disclosure characterization as unsupported. The practical risk is a reliable crash of the reader when a victim opens a crafted CHM file; this is nuisance/DoS-grade rather than a code-execution threat. The one aggravating factor is that no fixed version is available as of this review.

An attacker crafts a malicious CHM (compiled HTML Help) file with a /#WINDOWS or /#IVB string offset that, when narrowed to a signed integer, becomes negative, and delivers it to a victim (e.g., via email or download). When the victim opens the file in SumatraPDF 3.6.1 or earlier, ChmFile::GetCharZ() reads before the /#STRINGS buffer and the application deterministically crashes. No public exploit code is identified; only the fixing commit is available.