Is CVE-2026-107730 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-107730 being exploited in the wild.

How severe is CVE-2026-107730?

Medium severity, with a CVSS score of 5.5, published 8 October 2026.

Is there a fix for CVE-2026-107730?

A patch was published on 2026-10-08: commit 10a83278a5a6f67194dedfb67c47474d22ecfe4b Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-107730 attacked?

It is attacked with local access, in a software library.

Am I affected by CVE-2026-107730?

Check whether you run SumatraPDF at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-107730: SumatraPDF integer overflow in LIT header parsing

CVE-2026-107730 · Severity: medium · CVSS 5.5 · Published 2026-10-08

SumatraPDF is a Windows document reader that handles multiple file formats, including Microsoft Reader .lit files. When opening a crafted .lit file, an integer overflow in header parsing causes the application to crash reliably, denying users access to the file and disrupting productivity.

Technologies: SumatraPDF. Vendors: SumatraPDF.

Quick answers

Is CVE-2026-107730 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-107730 being exploited in the wild.
How severe is CVE-2026-107730?: Medium severity, with a CVSS score of 5.5, published 8 October 2026.
Which products and versions are affected?: SumatraPDF 3.7.0.22298.
Is there a fix for CVE-2026-107730?: A patch was published on 2026-10-08: commit 10a83278a5a6f67194dedfb67c47474d22ecfe4b Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-107730 attacked?: It is attacked with local access, in a software library.
Am I affected by CVE-2026-107730?: Check whether you run SumatraPDF at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

In src/LitDoc.cpp, LitParseHeader() computes a section offset as hdrLen + nPieces * 16 using signed 32-bit arithmetic on attacker-controlled values without validating the complete result. A malicious .lit file can force this calculation to wrap to a negative value, causing an invalid-pointer read in LitU32() and terminating the process. The vulnerability requires local file access and user interaction (opening the file) to trigger.

Affected products

SumatraPDF SumatraPDF 3.7.0.22298

Timeline

2026-09-16: disclosed
2026-10-08: patched: commit 10a83278a5a6f67194dedfb67c47474d22ecfe4b

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.