What is the CVSS score of CVE-2026-88361?

CVE-2026-88361 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H. EPSS exploitation probability: 0.2%.

How to fix or mitigate CVE-2026-88361?

Within 24 hours, confirm which endpoints run SumatraPDF 3.6.1 and direct users to avoid opening PDFs from untrusted, unsolicited, or external sources with it, routing such files to an alternate fully patched reader where possible. Within 7 days, complete an inventory of affected installations, validate that the alternate-reader workflow is in place for untrusted document intake, and configure EDR or application monitoring to detect repeated SumatraPDF crashes that could indicate attempted abuse. Within 30 days, track the vendor advisory for a fixed SumatraPDF release and deploy it after standard validation, and re-assess priority if the vendor publishes a patch, EPSS rises, public exploit code appears, or CISA adds the issue to KEV; no vendor-released patch is available at this time.

SumatraPDF CVE-2026-88361

EUVD-2026-86287 HIGH

Integer Overflow or Wraparound (CWE-190)

2026-09-24 mitre

GHSA-42pv-g2vh-7hf6

Buffer Overflow Integer Overflow Sumatrapdf

7.5

CVSS 3.1 · Vendor: mitre

View

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain

Access

Craft PDF with /St near INT_MAX
Delivery

Deliver malicious PDF to victim
Exploit

Victim opens file in SumatraPDF
Execution

Integer overflow in BuildPageLabelRec
Impact

Application crash / denial of service

Vulnerability Assessment

Weakness	CWE CWE-190 ASVS 5.0 V15 - Secure Coding and Architecture Integer overflow checks MITRE ATT&CK 1 technique across 1 tactic: Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. Sign in to read
Exploitation Conditions	Exploitation requires the victim to open an attacker-crafted PDF in SumatraPDF 3.6.1 whose PageLabels /Nums array supplies an /St (start-at) integer value near INT_MAX, causing signed integer overflow in EngineMupdf::BuildPageLabelRec(). This is a client-side file-parsing flaw: it cannot be triggered without user interaction (the user must open the malicious document), which sharply limits realistic exploitation compared to the network/no-interaction CVSS vector. Impact is limited to a crash/denial of service of the local reader process; there is no code execution, confidentiality, or integrity impact indicated by the data or the fix.
Impact	The provided CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, base 7.5) treats this as a remote, unauthenticated, no-interaction availability flaw, but that characterization is inconsistent with the nature of the product: SumatraPDF is a desktop PDF reader and this bug is triggered only when the application parses a crafted PDF's PageLabels /Nums entry. Realistically the vector is local file-borne with required user interaction (opening the malicious PDF), so the true attack vector is AV:L/UI:R, not AV:N/UI:N - the NVD-assigned network/no-UI metrics appear overstated and should be verified. The impact is confined to availability (C:N/I:N/A:H): a signed integer overflow (INT_MAX + 1, undefined behavior per the fix comments and issue #5952) leading to a crash/denial of service, with no evidence of confidentiality or integrity impact. Corroborating exploitation signals are weak-to-absent: EPSS is very low at 0.17% (5th percentile), there is no CISA KEV listing, and no public exploit code was identified (only upstream/fork fix commits and a public issue report exist). Taken together, this is a high-nominal-CVSS but low-real-priority issue - a client-side DoS requiring the victim to open an attacker-supplied file, with no observed exploitation and low predicted exploitation probability.
Exploit ScenarioDerived	An attacker crafts a PDF whose PageLabels dictionary contains a /Nums entry with an /St (start-at) integer near INT_MAX and distributes it via email, web download, or a shared drive. When a victim opens the file in SumatraPDF 3.6.1, BuildPageLabelRec() computes INT_MAX + 1 as a signed int, triggering integer overflow (undefined behavior) and crashing the application. No public exploit code was identified, though upstream fix commits and issue #5952 publicly document the flawed code path.

This Week Schedule remediation this week. Why: HIGH severity (CVSS 7.0-8.9).

No patch listed yet 0.2% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv1 – Sep 25, 2026

Parsing a malformed PDF in SumatraPDF 3.6.1 can crash the reader through a signed integer overflow in the PageLabels handling code, producing a local denial-of-service condition. The bug is reached only when a user opens an attacker-crafted document whose /Nums array supplies an /St (start-at) value near INT_MAX, which overflows in EngineMupdf::BuildPageLabelRec(); an independent assessment scores this as AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H (base 7.5 as published, but the network/no-interaction vector is inconsistent with a desktop file-parsing flaw that needs user interaction). There is no confirmed code execution, confidentiality or integrity impact, no public exploit code identified at time of analysis, no CISA KEV listing, and EPSS is only 0.17% (5th percentile), so exploit likelihood is low.

RemediationAI

No vendor-released patched version number is confirmed in the provided data; the state of the fix is best described as upstream fix available (PR/commit) with a released patched build not independently confirmed. The two commits (https://github.com/haimag/sumatrapdf/commit/8b999ff1bf0a8df244e75440682a3fd9a038eb2d and https://github.com/chenjiefeng2001/sumatrapdf_folked/commit/b22a8c71ddc9de80ece5f88d14b434c20fee912e) widen the /St addition to 64-bit, reject startAt values below 1 or above pageCount, and clamp countFrom to at most INT_MAX - pageCount; track https://github.com/sumatrapdfreader/sumatrapdf/issues/5952 and install a SumatraPDF build that contains these changes once the project ships one, verifying the fix by confirming the range check and limitValue clamp are present in the build's EngineMupdf.cpp. Until then, treat untrusted PDFs as potentially crashing input: open them in a disposable or sandboxed environment (Windows Sandbox, AppContainer/low-privilege account, or a VM) so a reader crash cannot affect the host, accepting the overhead and workflow friction this adds; alternatively use a different PDF reader for documents of unknown provenance, which avoids the defect but changes tooling and rendering behavior. Pre-sanitizing or re-writing PDFs to normalize PageLabels /Nums /St values can remove the trigger, but this is fragile because it depends on the sanitizer catching every encoding of the value and it may alter page-numbering metadata. Because the realistic impact is a local crash with no code execution, confidentiality or integrity loss reported in the data, a crash-isolation posture plus timely upgrade is proportionate; blocking network ports or adding network filtering is not a meaningful control here since exploitation requires the victim to open the crafted file locally.

Affected VersionsENISA

n/a n/a

Affects your stack

Find out whether the stacks and servers you run are on an affected version.

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Technical ContextAI · show details

SumatraPDF renders PDFs through an embedded MuPDF engine, and EngineMupdf.cpp bridges MuPDF objects into the reader's own page-label structures. CWE-190 (integer overflow) applies because the code took an attacker-controlled /St integer from a PageLabels /Nums entry, added 1 in a 32-bit int, and then used the result in a second arithmetic step where countFrom + j (j up to pageCount) could also exceed INT_MAX, causing signed overflow and undefined behavior. The upstream fix commit converts the addition to a 64-bit (i64) value and adds a range check rejecting startAt < 1 or startAt > pageCount before narrowing back to int, and clamps countFrom with limitValue(countFrom, 1, INT_MAX - pageCount) specifically so the later countFrom + j summation remains representable. The CPE data supplied is unpopulated (cpe:2.3:a:n/a:n/a:*), and EUVD lists the affected version as "n/a n/a"; the only concrete version evidence in the input is the description's reference to SumatraPDF 3.6.1. Impact is confined to an availability failure of the local reader process, consistent with the assessed CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H.

Know when Sumatrapdf gets its next vulnerability

Watch products and get an email when something new is published
Check this CVE against your own stack and servers
Exploit and PoC references, threat intelligence from 22 sources

Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

Vendor (mitre) PRIMARY 7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

vuln.today AI 5.5 MEDIUM

SumatraPDF is a desktop reader parsing a locally-opened file, so AV:L and UI:R; no auth needed (PR:N); crash-only impact yields A:H with C:N/I:N.

3.1 AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

4.0 AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (mitre).

CVSS VectorVendor: mitre

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

Lifecycle Timeline

CVSS changed

Sep 25, 2026 - 18:22 NVD

7.5 (HIGH)

CVE Published

Sep 24, 2026 - 00:00 cve.org

HIGH 7.5

CVE Published

Sep 24, 2026 - 00:00 cve.org

UNKNOWN (no severity yet)

DescriptionCVE.org

SumatraPDF 3.6.1 contains an integer overflow vulnerability in EngineMupdf::BuildPageLabelRec() when parsing PDF PageLabels /Nums entries.

Executive ViewAI

Why It Matters

SumatraPDF 3.6.1 users can be disrupted by a malformed PDF that crashes the reader, creating a local denial-of-service condition that affects availability only, with no data exposure or code execution. Risk to the organization is contained because exploitation requires a user to open a crafted document on their own machine and no public exploit has been identified, but teams that rely on this reader for untrusted document intake should treat it as a manageable operational gap until a fix ships.

Business Impact: Low

Compensating Controls

No vendor-released patch identified at time of analysis. Interim mitigations: quarantine or block untrusted PDFs before they reach SumatraPDF 3.6.1, direct users to an alternate patched PDF reader for untrusted documents, apply application allow-listing and EDR monitoring for SumatraPDF crash activity, and reinforce user guidance against opening unsolicited files; deploy the vendor patch once released.

Threat Intelligence Overview

EPSS Score

0.2%

Top 95% exploitable

Prevalence

Medium

popular free Windows PDF reader, common but not universally deployed

Data Quality

5 sources

Confidence: Medium

EUVD

NVD

CVE.org

EPSS

GitHub

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue

Severity HIGH

CISA KEV No

Public POC No

EPSS 0.2%

Patch available No

Active threat No

Deciding rule

HIGH severity (CVSS 7.0-8.9)

What every action level means

Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.

Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.

This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.

This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.

Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision· derived

Scheduled

Exploitation· derived

None

System Exposure· derived

Open

Automatable· derived

Yes

Human Impact

Low

Priority Score

Low Medium High Critical

KEV: 0

EPSS: 0

CVSS: +38

PoC: 0

Weaponized: 0

Threat intel: 0

Gov advisory: 0

Attack Technique

Buffer Overflow HIGH

A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.

Integer Overflow MEDIUM

Integer overflow occurs when an arithmetic operation produces a result that exceeds the maximum value a given integer type can store.