EUVD-2026-63469Severity by source
AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:H/A:L
File must be opened locally (AV:L, UI:R); no privileges needed to open a file (PR:N); overflow trigger is simple (AC:L); heap corruption reliably crashes the process (A:H) and could corrupt adjacent state (I:H).
Primary rating from Vendor (GitHub_M).
CVSS VectorVendor: GitHub_M
Lifecycle Timeline
3DescriptionCVE.org
SumatraPDF is a multi-format reader for Windows. In 3.6.1 and earlier, a crafted CHM file can supply malformed LZX Huffman code lengths to make_decode_table in ext/CHMLib/lzx.c. In the long-code branch, the function writes new internal nodes through next_symbol before validating that the canonical Huffman table has overflowed. The PRETREE case can write beyond the 104-entry PRETREE_table into adjacent heap state in struct LZXstate when reached through chm_open, chm_retrieve_object, LZXdecompress, and BUILD_TABLE. This produces heap memory corruption in the parser process, while arbitrary code execution has not been demonstrated. No fixed version is available as of this review.
AnalysisAI
Heap buffer overflow in SumatraPDF 3.6.1 and earlier enables an attacker who delivers a crafted CHM file to corrupt parser heap memory via malformed LZX Huffman code lengths. The PRETREE path in make_decode_table writes internal Huffman tree nodes beyond the 104-entry PRETREE_table boundary into adjacent struct LZXstate heap memory, reachable through the chm_open → chm_retrieve_object → LZXdecompress → BUILD_TABLE call chain. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires that a user open a specially crafted CHM (.chm) file in SumatraPDF 3.6.1 or earlier on Windows. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 3.1 score of 6.6 (AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:H/A:L) correctly frames this as a local, user-triggered file-parsing flaw - exploitation requires convincing a user to open a crafted CHM file, which is the primary friction point. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | No released patched version is available as of this review; the upstream fix exists only as untagged commit 13b3d4204dd12d93d426f2157b157b149edc29bf (https://github.com/sumatrapdfreader/sumatrapdf/commit/13b3d4204dd12d93d426f2157b157b149edc29bf). … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Sumatrapdf
View allSumatraPDF 3.5.2 and earlier on Windows contains an untrusted search path vulnerability in the Advanced Options feature
SumatraPDF 3.5.2 and earlier on Windows allows arbitrary code execution when a user opens a PDF and selects "Show in fol
SumatraPDF versions 3.5.0 through 3.5.2 fail to validate TLS certificates during software updates and execute installers
Heap-based buffer overflow in SumatraPDF before 2.1 allows remote attackers to execute arbitrary code via a crafted PDF
Heap-based buffer overflow in SumatraPDF before 2.1 allows remote attackers to execute arbitrary code via a crafted PDF
SumatraPDF versions 3.5.2 and earlier are vulnerable to a heap buffer over-read in the MOBI file parser due to incomplet
SumatraPDF on Windows is vulnerable to a denial-of-service attack through a maliciously crafted Mobi file that triggers
A buffer overflow in SumatraPDF Reader v3.4.6 allows attackers to cause a Denial of Service (DoS) via a crafted text fil
A null pointer dereference vulnerability was discovered in SumatraPDF 3.5.2 during the processing of a crafted .djvu fil
Same weakness CWE-119 – Buffer Overflow
View allShare
External POC / Exploit Code
Leaving vuln.today