# CVE-2026-107736: SumatraPDF stack buffer overflow in EXIF Orientation parsing

Source: https://junglewise.ai/threats/cve-2026-107736-sumatrapdf-is-a-multi-format-reader-for-windows-in-3-6-1-and  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-08. Updated: 2026-10-16  
License: CC BY 4.0 with a link back

CVE-2026-107736 · Severity: info · Published 2026-10-08

SumatraPDF is a document and image reader for Windows. A crafted TIFF file with malicious EXIF Orientation metadata can trigger a stack buffer overflow when opened, allowing an attacker to overwrite control data on the stack. While tested builds crash before code execution due to stack cookie validation, the vulnerability gives precise control over stack memory and could be a stepping stone for attacks.

Technologies: [SumatraPDF](https://junglewise.ai/threats/technologies/sumatrapdf). Vendors: [SumatraPDF](https://junglewise.ai/threats/vendors/sumatrapdf).

## Quick answers

**Is CVE-2026-107736 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-107736 being exploited in the wild.

**How severe is CVE-2026-107736?** Informational severity, published 8 October 2026.

**Which products and versions are affected?** SumatraPDF 3.6.1 and earlier.

**Is there a fix for CVE-2026-107736?** No fixed version is recorded yet. Do not open TIFF files from untrusted sources until an updated version is available. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-107736 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-107736?** Check whether you run SumatraPDF at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix


Do not open TIFF files from untrusted sources until an updated version is available.

## Technical details

The MaybeFlipBitmap() function allocates a fixed 64-byte stack buffer and calls GDI+ GetPropertyItem() with an attacker-controlled size derived from the EXIF Orientation property. A crafted TIFF can report a property size larger than the buffer (e.g., 96 bytes from 36 Orientation SHORT values), causing GDI+ to write past the buffer and overwrite the stack cookie, saved registers, and return address. The diagnostic ReportIf() guard did not prevent execution, only reported it.

## Affected products

- SumatraPDF SumatraPDF 3.6.1 and earlier

## Timeline

- 2026-09-16: disclosed
- 2026-10-08: advisory

## References

- [https://github.com/sumatrapdfreader/sumatrapdf/commit/6fe2e0239d8ef3466174ac92f3f56e967ce1a4a7](https://github.com/sumatrapdfreader/sumatrapdf/commit/6fe2e0239d8ef3466174ac92f3f56e967ce1a4a7)
- [https://github.com/sumatrapdfreader/sumatrapdf/security/advisories/GHSA-px68-7vwv-mxpr](https://github.com/sumatrapdfreader/sumatrapdf/security/advisories/GHSA-px68-7vwv-mxpr)

## Related threats

- [SumatraPDF TLS hostname validation bypass in HttpGet](https://junglewise.ai/threats/cve-2026-115758-sumatrapdf-is-a-multi-format-reader-for-windows-in-version-3-6-1)
- [SumatraPDF command-line argument injection in AI translation](https://junglewise.ai/threats/cve-2026-107802-sumatrapdf-is-a-multi-format-reader-for-windows-in-3-6-1-and)
- [SumatraPDF out-of-bounds read in CHM parser](https://junglewise.ai/threats/cve-2026-107738-sumatrapdf-is-a-multi-format-reader-for-windows-in-3-6-1-and)
- [SumatraPDF out-of-bounds pointer read in its:// window lookup](https://junglewise.ai/threats/cve-2026-107737-sumatrapdf-is-a-multi-format-reader-for-windows-in-3-6-1-and)
- [SumatraPDF restriction policy initialization fail-open](https://junglewise.ai/threats/cve-2026-107735-sumatrapdf-is-a-multi-format-reader-for-windows-in-3-6-1-and)