EUVD-2026-63469Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
ReconDeliver crafted CHM file to target via phishing or download
-
DeliveryTarget opens file in SumatraPDF
-
Exploitchm_open invokes LZXdecompress
-
Installmake_decode_table processes malformed PRETREE code lengths
-
C2Long-code branch writes beyond 104-entry PRETREE_table
-
ExecuteHeap corruption in struct LZXstate
-
ImpactProcess crash or potential code execution
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Bounds checking, buffer size validation
MITRE ATT&CK
2 techniques across 2 tactics: Execution, Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires that a user open a specially crafted CHM (.chm) file in SumatraPDF 3.6.1 or earlier on Windows. The CHM file must contain malformed LZX Huffman code lengths that trigger the long-code branch in make_decode_table and cause PRETREE table construction to exceed its 104-entry boundary. No network-reachable service, authentication, elevated privileges, or non-default configuration is required - the sole prerequisite is user interaction (opening the file). Exploitation is constrained to the SumatraPDF parser process's heap (scope unchanged), and arbitrary code execution beyond heap corruption has not been demonstrated, limiting confirmed worst-case impact to process crash and heap memory corruption. |
| Impact | The CVSS 3.1 score of 6.6 (AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:H/A:L) correctly frames this as a local, user-triggered file-parsing flaw - exploitation requires convincing a user to open a crafted CHM file, which is the primary friction point. No EPSS score was provided in the available intelligence, and the vulnerability does not appear in the CISA KEV catalog, indicating no confirmed active exploitation at time of analysis. The input tags include 'RCE,' but the CVE description explicitly qualifies that arbitrary code execution has not been demonstrated; the I:H CVSS rating therefore reflects potential rather than confirmed capability, and risk assessors should weight this accordingly. The upstream fix commit exists (13b3d4204dd12d93d426f2157b157b149edc29bf) but no tagged release incorporating it has shipped, meaning all production installations on 3.6.1 and earlier remain unpatched. Organizations with CHM-heavy documentation workflows or helpdesk tooling that relies on SumatraPDF for CHM rendering face the most realistic exposure, while general desktop deployments are limited by the social-engineering prerequisite. |
| Exploit ScenarioDerived | An attacker crafts a CHM file in which the embedded LZX-compressed data supplies malformed PRETREE Huffman code lengths - for example, assigning code length 15 to all PRETREE symbols - and delivers it via a phishing email or malicious download. When the victim opens the file in SumatraPDF 3.6.1, the LZX decompressor invokes make_decode_table, which writes internal tree nodes beyond the 104-entry PRETREE_table into adjacent LZXstate heap memory. The most probable outcome is a parser crash; a worst-case scenario would involve an attacker shaping adjacent heap contents to redirect execution, though this has not been demonstrated publicly. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Aug 20, 2026
Heap buffer overflow in SumatraPDF 3.6.1 and earlier enables an attacker who delivers a crafted CHM file to corrupt parser heap memory via malformed LZX Huffman code lengths. The PRETREE path in make_decode_table writes internal Huffman tree nodes beyond the 104-entry PRETREE_table boundary into adjacent struct LZXstate heap memory, reachable through the chm_open → chm_retrieve_object → LZXdecompress → BUILD_TABLE call chain. No public exploit or active exploitation is confirmed; arbitrary code execution has not been demonstrated, though the upstream fix commit validates that reliable heap corruption is achievable.
RemediationAI
No released patched version is available as of this review; the upstream fix exists only as untagged commit 13b3d4204dd12d93d426f2157b157b149edc29bf (https://github.com/sumatrapdfreader/sumatrapdf/commit/13b3d4204dd12d93d426f2157b157b149edc29bf). Monitor the SumatraPDF release page and upgrade immediately upon a release that incorporates this commit. As compensating controls in the interim: disable CHM file-type associations system-wide via Group Policy or AppLocker to prevent SumatraPDF from processing CHM files at all (trade-off: legitimate CHM documentation workflows will break and require an alternative viewer); configure email security gateways and web proxies to quarantine or block .chm file transfers, which eliminates the primary delivery vector with minimal operational impact; if CHM support is not required in the environment, consider switching to an alternative document viewer that does not implement CHM parsing. Users should be advised via security awareness communications not to open CHM files from untrusted or unexpected sources until a patched release is confirmed.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
SumatraPDF bundles CHMLib to parse Microsoft Compiled HTML Help (.CHM) files, which use the LZX compression algorithm. The flaw is in make_decode_table (ext/CHMLib/lzx.c), which constructs canonical Huffman decode tables from code lengths embedded in the compressed stream. When a crafted CHM supplies malformed LZX Huffman code lengths - such as all PRETREE symbols assigned length 15 - the long-code branch increments next_symbol and writes new internal tree nodes before checking whether the allocation boundary (table_mask + (nsyms << 1)) has been exceeded. This allows out-of-bounds writes into heap memory adjacent to the 104-entry PRETREE_table within the heap-allocated struct LZXstate. CWE-119 (Improper Restriction of Operations within the Bounds of a Memory Buffer) is the root-cause class. The upstream fix, visible in commit 13b3d4204dd12d93d426f2157b157b149edc29bf, adds a bounds check: if ((next_symbol << 1) + 1 >= table_elems) return 1; - confirming the write-before-validate pattern. Affected CPE: cpe:2.3:a:sumatrapdfreader:sumatrapdf:*:*:*:*:*:*:*:*.
Know when Sumatrapdf gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:H/A:L
File must be opened locally (AV:L, UI:R); no privileges needed to open a file (PR:N); overflow trigger is simple (AC:L); heap corruption reliably crashes the process (A:H) and could corrupt adjacent state (I:H).
Primary rating from Vendor (GitHub_M).
CVSS VectorVendor: GitHub_M
DescriptionCVE.org
SumatraPDF is a multi-format reader for Windows. In 3.6.1 and earlier, a crafted CHM file can supply malformed LZX Huffman code lengths to make_decode_table in ext/CHMLib/lzx.c. In the long-code branch, the function writes new internal nodes through next_symbol before validating that the canonical Huffman table has overflowed. The PRETREE case can write beyond the 104-entry PRETREE_table into adjacent heap state in struct LZXstate when reached through chm_open, chm_retrieve_object, LZXdecompress, and BUILD_TABLE. This produces heap memory corruption in the parser process, while arbitrary code execution has not been demonstrated. No fixed version is available as of this review.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
GitHub
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.
Remote Code Execution represents the critical moment when an attacker successfully runs arbitrary code on a target system without physical access.
More in Sumatrapdf
View allSumatraPDF 3.5.2 and earlier on Windows contains an untrusted search path vulnerability in the Advanced Options feature
SumatraPDF 3.5.2 and earlier on Windows allows arbitrary code execution when a user opens a PDF and selects "Show in fol
SumatraPDF versions 3.5.0 through 3.5.2 fail to validate TLS certificates during software updates and execute installers
Heap-based buffer overflow in SumatraPDF before 2.1 allows remote attackers to execute arbitrary code via a crafted PDF
Heap-based buffer overflow in SumatraPDF before 2.1 allows remote attackers to execute arbitrary code via a crafted PDF
SumatraPDF versions 3.5.2 and earlier are vulnerable to a heap buffer over-read in the MOBI file parser due to incomplet
SumatraPDF on Windows is vulnerable to a denial-of-service attack through a maliciously crafted Mobi file that triggers
A buffer overflow in SumatraPDF Reader v3.4.6 allows attackers to cause a Denial of Service (DoS) via a crafted text fil
Local code execution in SumatraPDF 3.6.1 and earlier on Windows is possible when a user opens an attacker-supplied docum
Parsing a malformed PDF in SumatraPDF 3.6.1 can crash the reader through a signed integer overflow in the PageLabels han
Command-line argument injection in SumatraPDF 3.5.2 and earlier lets an attacker-controlled SyncTeX source filename esca
Argument injection in the AI translation feature of SumatraPDF 3.6.1 and earlier allows text placed in a document select
Exploit-DB