# CVE-2026-55586: SumatraPDF heap overflow in CHMLib LZX Huffman decompression

Source: https://junglewise.ai/threats/cve-2026-55586-sumatrapdf-heap-overflow-in-chmlib-lzx-huffman-decompression  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-08-20. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2026-55586 · Severity: medium · CVSS 6.6 · Published 2026-08-20

SumatraPDF is a document reader used to open CHM help files and other formats on Windows. A specially crafted CHM file can cause a heap memory overflow during decompression, potentially crashing the application or corrupting memory. While no active exploits have been demonstrated, this could be leveraged as part of a targeted attack via a malicious document.

Technologies: [SumatraPDF](https://junglewise.ai/threats/technologies/sumatrapdf). Vendors: [SumatraPDF](https://junglewise.ai/threats/vendors/sumatrapdf).

## Quick answers

**Is CVE-2026-55586 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-55586 being exploited in the wild.

**How severe is CVE-2026-55586?** Medium severity, with a CVSS score of 6.6, published 20 August 2026.

**Which products and versions are affected?** SumatraPDF 3.6.1 and earlier.

**Is there a fix for CVE-2026-55586?** A patch was published on 2026-06-14: Fix committed to repository but no patched release available at time of advisory Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-55586 attacked?** It is attacked over the network.

**Am I affected by CVE-2026-55586?** Check whether you run SumatraPDF at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The vulnerability is a heap out-of-bounds write in the make_decode_table() function within the vendored CHMLib LZX decompressor (ext/CHMLib/lzx.c). The function constructs Huffman decode tables from attacker-controlled code lengths without validating table bounds before writing. Specifically, in the long-code branch, the function writes internal nodes using next_symbol as an index before checking for table overflow, allowing next_symbol to advance past the 104-entry PRETREE_table into adjacent heap memory within the LZXstate structure. The vulnerability is reachable through normal CHM file parsing via chm_open() and chm_retrieve_object() without requiring direct library calls. A proof-of-concept demonstrates twelve 2-byte out-of-bounds writes. A commit on June 14, 2026 indicates a fix was developed, though no patched release was available at the time of advisory publication.

## Affected products

- SumatraPDF SumatraPDF 3.6.1 and earlier

## Timeline

- 2026-08-20: disclosed
- 2026-06-14: patched: Fix committed to repository but no patched release available at time of advisory

## References

- [https://github.com/sumatrapdfreader/sumatrapdf/commit/13b3d4204dd12d93d426f2157b157b149edc29bf](https://github.com/sumatrapdfreader/sumatrapdf/commit/13b3d4204dd12d93d426f2157b157b149edc29bf)
- [https://github.com/sumatrapdfreader/sumatrapdf/security/advisories/GHSA-m423-rp8p-whj8](https://github.com/sumatrapdfreader/sumatrapdf/security/advisories/GHSA-m423-rp8p-whj8)

## Related threats

- [SumatraPDF TLS hostname validation bypass in HttpGet](https://junglewise.ai/threats/cve-2026-115758-sumatrapdf-is-a-multi-format-reader-for-windows-in-version-3-6-1)
- [SumatraPDF command-line argument injection in AI translation](https://junglewise.ai/threats/cve-2026-107802-sumatrapdf-is-a-multi-format-reader-for-windows-in-3-6-1-and)
- [SumatraPDF out-of-bounds read in CHM parser](https://junglewise.ai/threats/cve-2026-107738-sumatrapdf-is-a-multi-format-reader-for-windows-in-3-6-1-and)
- [SumatraPDF out-of-bounds pointer read in its:// window lookup](https://junglewise.ai/threats/cve-2026-107737-sumatrapdf-is-a-multi-format-reader-for-windows-in-3-6-1-and)
- [SumatraPDF stack buffer overflow in EXIF Orientation parsing](https://junglewise.ai/threats/cve-2026-107736-sumatrapdf-is-a-multi-format-reader-for-windows-in-3-6-1-and)