Is CVE-2026-107737 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-107737 being exploited in the wild.

How severe is CVE-2026-107737?

Informational severity, published 8 October 2026.

Which products and versions are affected?

SumatraPDF 3.6.1 and earlier; pre-release 3.7.0.20369 (when WebView2 is absent or cannot initialize).

How is CVE-2026-107737 attacked?

It is attacked with local access.

Am I affected by CVE-2026-107737?

Check whether you run SumatraPDF at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-107737: SumatraPDF out-of-bounds pointer read in its:// window lookup

CVE-2026-107737 · Severity: info · Published 2026-10-08

SumatraPDF is a document reader for Windows that can open CHM (compiled help) files. When opening a crafted CHM file, an attacker can trigger an out-of-bounds memory read by supplying a negative window identifier in a custom its:// URL embedded in the document. This causes the application to crash and can potentially be leveraged for memory disclosure or code execution.

Technologies: SumatraPDF. Vendors: SumatraPDF.

Quick answers

Is CVE-2026-107737 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-107737 being exploited in the wild.
How severe is CVE-2026-107737?: Informational severity, published 8 October 2026.
Which products and versions are affected?: SumatraPDF 3.6.1 and earlier; pre-release 3.7.0.20369 (when WebView2 is absent or cannot initialize).
Is there a fix for CVE-2026-107737?: Yes: fixed in No fixed version available as of this advisory; fix pending in future release. Until then: Avoid opening CHM files from untrusted sources. If WebView2 is available on Windows systems where it will be used, ensure it is installed and properly initialized to avoid the IE fallback backend. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-107737 attacked?: It is attacked with local access.
Am I affected by CVE-2026-107737?: Check whether you run SumatraPDF at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Fixed in: No fixed version available as of this advisory; fix pending in future release

Avoid opening CHM files from untrusted sources. If WebView2 is available on Windows systems where it will be used, ensure it is installed and properly initialized to avoid the IE fallback backend.

Technical details

The ParseProtoUrl() function parses the host portion of an its:// URL as a signed decimal integer and passes it directly to FindHtmlWindowById(), which uses it as an index into the gHtmlWindows vector without bounds checking. A crafted CHM containing an img tag with src="its://-3/resource.txt" causes an out-of-bounds read of a qword before the vector's first element, which is then dereferenced as an HtmlWindow pointer, triggering an access violation. The vulnerability is reachable via the IE/MSHTML fallback backend when WebView2 is absent or fails to initialize.

Affected products

SumatraPDF SumatraPDF 3.6.1 and earlier; pre-release 3.7.0.20369 (when WebView2 is absent or cannot initialize)

Timeline

2026-07-29: disclosed
2026-10-08: advisory

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.