# CVE-2026-107738: SumatraPDF out-of-bounds read in CHM parser

Source: https://junglewise.ai/threats/cve-2026-107738-sumatrapdf-is-a-multi-format-reader-for-windows-in-3-6-1-and  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-08. Updated: 2026-10-16  
License: CC BY 4.0 with a link back

CVE-2026-107738 · Severity: info · Published 2026-10-08

SumatraPDF is a document reader for Windows that opens PDF, EPUB, CHM and other file formats. A malformed CHM file can crash the application by triggering an out-of-bounds memory read, causing loss of unsaved work. An attacker must trick a user into opening a specially crafted CHM file to exploit this vulnerability.

Technologies: [SumatraPDF](https://junglewise.ai/threats/technologies/sumatrapdf). Vendors: [SumatraPDF](https://junglewise.ai/threats/vendors/sumatrapdf).

## Quick answers

**Is CVE-2026-107738 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-107738 being exploited in the wild.

**How severe is CVE-2026-107738?** Informational severity, published 8 October 2026.

**Which products and versions are affected?** SumatraPDF 3.6.1 and earlier.

**Is there a fix for CVE-2026-107738?** A patch was published on 2026-10-08. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-107738 attacked?** It is attacked with local access, in a software library.

**Am I affected by CVE-2026-107738?** Check whether you run SumatraPDF at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

ChmFile::GetCharZ() in the CHM parser fails to validate that file-controlled string offsets remain nonnegative after conversion from unsigned 32-bit integers to signed integers. Offsets from /#WINDOWS and /#IVB streams become negative, bypass the upper-bound check, and cause memchr() and strlen() to read before the /#STRINGS buffer. The vulnerability requires opening a malicious CHM file but only reliably causes application termination; memory disclosure has not been demonstrated.

## Affected products

- SumatraPDF SumatraPDF 3.6.1 and earlier

## Timeline

- 2026-07-29: disclosed
- 2026-10-08: patched

## References

- [https://github.com/sumatrapdfreader/sumatrapdf/commit/62254ed6d781ceb5cd16489bb423e7f591cd72c4](https://github.com/sumatrapdfreader/sumatrapdf/commit/62254ed6d781ceb5cd16489bb423e7f591cd72c4)
- [https://github.com/sumatrapdfreader/sumatrapdf/security/advisories/GHSA-33jg-vxm6-8mxx](https://github.com/sumatrapdfreader/sumatrapdf/security/advisories/GHSA-33jg-vxm6-8mxx)

## Related threats

- [SumatraPDF TLS hostname validation bypass in HttpGet](https://junglewise.ai/threats/cve-2026-115758-sumatrapdf-is-a-multi-format-reader-for-windows-in-version-3-6-1)
- [SumatraPDF command-line argument injection in AI translation](https://junglewise.ai/threats/cve-2026-107802-sumatrapdf-is-a-multi-format-reader-for-windows-in-3-6-1-and)
- [SumatraPDF out-of-bounds pointer read in its:// window lookup](https://junglewise.ai/threats/cve-2026-107737-sumatrapdf-is-a-multi-format-reader-for-windows-in-3-6-1-and)
- [SumatraPDF stack buffer overflow in EXIF Orientation parsing](https://junglewise.ai/threats/cve-2026-107736-sumatrapdf-is-a-multi-format-reader-for-windows-in-3-6-1-and)
- [SumatraPDF restriction policy initialization fail-open](https://junglewise.ai/threats/cve-2026-107735-sumatrapdf-is-a-multi-format-reader-for-windows-in-3-6-1-and)