CVE-2026-55586: SumatraPDF heap overflow in CHMLib LZX Huffman decompression

CVE-2026-55586 · Severity: medium · CVSS 6.6 · Published 2026-08-20

SumatraPDF is a document reader used to open CHM help files and other formats on Windows. A specially crafted CHM file can cause a heap memory overflow during decompression, potentially crashing the application or corrupting memory. While no active exploits have been demonstrated, this could be leveraged as part of a targeted attack via a malicious document.

Technologies: SumatraPDF. Vendors: SumatraPDF.

Quick answers

Is CVE-2026-55586 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-55586 being exploited in the wild.
How severe is CVE-2026-55586?
Medium severity, with a CVSS score of 6.6, published 20 August 2026.
Which products and versions are affected?
SumatraPDF 3.6.1 and earlier.
Is there a fix for CVE-2026-55586?
A patch was published on 2026-06-14: Fix committed to repository but no patched release available at time of advisory Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-55586 attacked?
It is attacked over the network.
Am I affected by CVE-2026-55586?
Check whether you run SumatraPDF at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The vulnerability is a heap out-of-bounds write in the make_decode_table() function within the vendored CHMLib LZX decompressor (ext/CHMLib/lzx.c). The function constructs Huffman decode tables from attacker-controlled code lengths without validating table bounds before writing. Specifically, in the long-code branch, the function writes internal nodes using next_symbol as an index before checking for table overflow, allowing next_symbol to advance past the 104-entry PRETREE_table into adjacent heap memory within the LZXstate structure. The vulnerability is reachable through normal CHM file parsing via chm_open() and chm_retrieve_object() without requiring direct library calls. A proof-of-concept demonstrates twelve 2-byte out-of-bounds writes. A commit on June 14, 2026 indicates a fix was developed, though no patched release was available at the time of advisory publication.

Affected products

  • SumatraPDF SumatraPDF 3.6.1 and earlier

Timeline

  • 2026-08-20: disclosed
  • 2026-06-14: patched: Fix committed to repository but no patched release available at time of advisory

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.