CVE-2026-107730

MEDIUM 5.5

SumatraPDF: Signed integer overflow in the LIT header parsing causes invalid-pointer read

CVSS Score

5.5

EPSS Score

0.0%

EPSS Percentile

0th

SumatraPDF is a multi-format reader for Windows. In 3.7.0.22298, LitParseHeader() in src/LitDoc.cpp computes the attacker-controlled hdrLen + nPieces * 16 section offset using signed 32-bit arithmetic without validating the complete result. When the component values make that aggregate calculation overflow to a negative value, pointer construction reaches an invalid read in LitU32(), causing deterministic application termination. The supplied evidence does not demonstrate code execution, information disclosure, arbitrary read, or integrity impact. No fixed version is available as of this review.

CWE	CWE-190
Vendor	sumatrapdfreader
Product	sumatrapdf
Published	Oct 8, 2026

Stay Ahead of the Next One

Get instant alerts for sumatrapdfreader sumatrapdf

Be the first to know when new medium vulnerabilities affecting sumatrapdfreader sumatrapdf are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

CVSS v3 Breakdown

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

Attack Vector

Local

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

Affected Versions

sumatrapdfreader / sumatrapdf

<= 3.7.0.22298

References

NVD ↗ CVE.org ↗ EPSS Data ↗

github.com: https://github.com/sumatrapdfreader/sumatrapdf/security/advisories/GHSA-vfpj-qhvj-92wg github.com: https://github.com/sumatrapdfreader/sumatrapdf/commit/10a83278a5a6f67194dedfb67c47474d22ecfe4b