Executive brief
SumatraPDF is a document reader used to open CHM help files and other formats on Windows. A specially crafted CHM file can cause a heap memory overflow during decompression, potentially crashing the application or corrupting memory. While no active exploits have been demonstrated, this could be leveraged as part of a targeted attack via a malicious document.
Technical details
The vulnerability is a heap out-of-bounds write in the make_decode_table() function within the vendored CHMLib LZX decompressor (ext/CHMLib/lzx.c). The function constructs Huffman decode tables from attacker-controlled code lengths without validating table bounds before writing. Specifically, in the long-code branch, the function writes internal nodes using next_symbol as an index before checking for table overflow, allowing next_symbol to advance past the 104-entry PRETREE_table into adjacent heap memory within the LZXstate structure. The vulnerability is reachable through normal CHM file parsing via chm_open() and chm_retrieve_object() without requiring direct library calls. A proof-of-concept demonstrates twelve 2-byte out-of-bounds writes. A commit on June 14, 2026 indicates a fix was developed, though no patched release was available at the time of advisory publication.
Affected products
- SumatraPDF SumatraPDF 3.6.1 and earlier
Timeline
- 2026-08-20: disclosed
- 2026-06-14: patched: Fix committed to repository but no patched release available at time of advisory