# CVE-2026-107730: SumatraPDF integer overflow in LIT header parsing

Source: https://junglewise.ai/threats/cve-2026-107730-sumatrapdf-is-a-multi-format-reader-for-windows-in-3-7-0-22298  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-08. Updated: 2026-10-16  
License: CC BY 4.0 with a link back

CVE-2026-107730 · Severity: medium · CVSS 5.5 · Published 2026-10-08

SumatraPDF is a Windows document reader that handles multiple file formats, including Microsoft Reader .lit files. When opening a crafted .lit file, an integer overflow in header parsing causes the application to crash reliably, denying users access to the file and disrupting productivity.

Technologies: [SumatraPDF](https://junglewise.ai/threats/technologies/sumatrapdf). Vendors: [SumatraPDF](https://junglewise.ai/threats/vendors/sumatrapdf).

## Quick answers

**Is CVE-2026-107730 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-107730 being exploited in the wild.

**How severe is CVE-2026-107730?** Medium severity, with a CVSS score of 5.5, published 8 October 2026.

**Which products and versions are affected?** SumatraPDF 3.7.0.22298.

**Is there a fix for CVE-2026-107730?** A patch was published on 2026-10-08: commit 10a83278a5a6f67194dedfb67c47474d22ecfe4b Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-107730 attacked?** It is attacked with local access, in a software library.

**Am I affected by CVE-2026-107730?** Check whether you run SumatraPDF at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

In src/LitDoc.cpp, LitParseHeader() computes a section offset as hdrLen + nPieces * 16 using signed 32-bit arithmetic on attacker-controlled values without validating the complete result. A malicious .lit file can force this calculation to wrap to a negative value, causing an invalid-pointer read in LitU32() and terminating the process. The vulnerability requires local file access and user interaction (opening the file) to trigger.

## Affected products

- SumatraPDF SumatraPDF 3.7.0.22298

## Timeline

- 2026-09-16: disclosed
- 2026-10-08: patched: commit 10a83278a5a6f67194dedfb67c47474d22ecfe4b

## References

- [https://github.com/sumatrapdfreader/sumatrapdf/commit/10a83278a5a6f67194dedfb67c47474d22ecfe4b](https://github.com/sumatrapdfreader/sumatrapdf/commit/10a83278a5a6f67194dedfb67c47474d22ecfe4b)
- [https://github.com/sumatrapdfreader/sumatrapdf/security/advisories/GHSA-vfpj-qhvj-92wg](https://github.com/sumatrapdfreader/sumatrapdf/security/advisories/GHSA-vfpj-qhvj-92wg)

## Related threats

- [SumatraPDF TLS hostname validation bypass in HttpGet](https://junglewise.ai/threats/cve-2026-115758-sumatrapdf-is-a-multi-format-reader-for-windows-in-version-3-6-1)
- [SumatraPDF command-line argument injection in AI translation](https://junglewise.ai/threats/cve-2026-107802-sumatrapdf-is-a-multi-format-reader-for-windows-in-3-6-1-and)
- [SumatraPDF out-of-bounds read in CHM parser](https://junglewise.ai/threats/cve-2026-107738-sumatrapdf-is-a-multi-format-reader-for-windows-in-3-6-1-and)
- [SumatraPDF out-of-bounds pointer read in its:// window lookup](https://junglewise.ai/threats/cve-2026-107737-sumatrapdf-is-a-multi-format-reader-for-windows-in-3-6-1-and)
- [SumatraPDF stack buffer overflow in EXIF Orientation parsing](https://junglewise.ai/threats/cve-2026-107736-sumatrapdf-is-a-multi-format-reader-for-windows-in-3-6-1-and)