# SumatraPDF vulnerabilities Source: https://junglewise.ai/threats/technologies/sumatrapdf Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats Updated: 12 November 2026, 03:07 UTC. Rebuilt every hour. Data: https://junglewise.ai/threats/technologies/sumatrapdf.json License: CC BY 4.0 with a link back Junglewise Threat Intelligence has tracked 13 vulnerabilities in SumatraPDF: 0 in the last 7 days and 13 in the last 90 days, 0 of them critical and 0 exploited in the wild. The most recent, CVE-2026-115758, was published on 4 November 2026. 1 vulnerability in the last four weeks, down 91% on the four before (11). ## Counts - Last 7 days: 0 - Last 30 days: 1 - Last 90 days: 13 - All time: 13 (0 critical, 0 exploited in the wild) ## About SumatraPDF SumatraPDF is a lightweight PDF reader and viewer for Windows. ## Latest SumatraPDF vulnerabilities - [CVE-2026-115758: SumatraPDF TLS hostname validation bypass in HttpGet](https://junglewise.ai/threats/cve-2026-115758-sumatrapdf-is-a-multi-format-reader-for-windows-in-version-3-6-1) (info, published 4 Nov 2026) - [CVE-2026-107802: SumatraPDF command-line argument injection in AI translation](https://junglewise.ai/threats/cve-2026-107802-sumatrapdf-is-a-multi-format-reader-for-windows-in-3-6-1-and) (info, published 8 Oct 2026) - [CVE-2026-107738: SumatraPDF out-of-bounds read in CHM parser](https://junglewise.ai/threats/cve-2026-107738-sumatrapdf-is-a-multi-format-reader-for-windows-in-3-6-1-and) (info, published 8 Oct 2026) - [CVE-2026-107737: SumatraPDF out-of-bounds pointer read in its:// window lookup](https://junglewise.ai/threats/cve-2026-107737-sumatrapdf-is-a-multi-format-reader-for-windows-in-3-6-1-and) (info, published 8 Oct 2026) - [CVE-2026-107736: SumatraPDF stack buffer overflow in EXIF Orientation parsing](https://junglewise.ai/threats/cve-2026-107736-sumatrapdf-is-a-multi-format-reader-for-windows-in-3-6-1-and) (info, published 8 Oct 2026) - [CVE-2026-107735: SumatraPDF restriction policy initialization fail-open](https://junglewise.ai/threats/cve-2026-107735-sumatrapdf-is-a-multi-format-reader-for-windows-in-3-6-1-and) (info, published 8 Oct 2026) - [CVE-2026-107733: SumatraPDF null-pointer dereference in CmdExec](https://junglewise.ai/threats/cve-2026-107733-sumatrapdf-is-a-multi-format-reader-for-windows-in-3-6-1-and) (info, published 8 Oct 2026) - [CVE-2026-107732: SumatraPDF command injection in notification markup](https://junglewise.ai/threats/cve-2026-107732-sumatrapdf-is-a-multi-format-reader-for-windows-in-3-6-1-and) (info, published 8 Oct 2026) - [CVE-2026-107731: SumatraPDF integer overflow in LIT parser range validation](https://junglewise.ai/threats/cve-2026-107731-sumatrapdf-is-a-multi-format-reader-for-windows-in-3-7-0-22298) (medium, CVSS 5.5, published 8 Oct 2026) - [CVE-2026-107730: SumatraPDF integer overflow in LIT header parsing](https://junglewise.ai/threats/cve-2026-107730-sumatrapdf-is-a-multi-format-reader-for-windows-in-3-7-0-22298) (medium, CVSS 5.5, published 8 Oct 2026) - [CVE-2026-107729: SumatraPDF out-of-bounds read in MOBI header parsing](https://junglewise.ai/threats/cve-2026-107729-sumatrapdf-is-a-multi-format-reader-for-windows-in-3-7-0-22298) (medium, CVSS 5.5, published 8 Oct 2026) - [CVE-2026-88361: SumatraPDF integer overflow in PageLabels parsing](https://junglewise.ai/threats/cve-2026-88361-sumatrapdf-3-6-1-contains-an-integer-overflow-vulnerability-in) (high, CVSS 7.5, published 24 Sep 2026) - [CVE-2026-55586: SumatraPDF heap overflow in CHMLib LZX Huffman decompression](https://junglewise.ai/threats/cve-2026-55586-sumatrapdf-heap-overflow-in-chmlib-lzx-huffman-decompression) (medium, CVSS 6.6, published 20 Aug 2026) ## Most severe SumatraPDF vulnerabilities - [CVE-2026-88361: SumatraPDF integer overflow in PageLabels parsing](https://junglewise.ai/threats/cve-2026-88361-sumatrapdf-3-6-1-contains-an-integer-overflow-vulnerability-in) (high, CVSS 7.5, published 24 Sep 2026) - [CVE-2026-55586: SumatraPDF heap overflow in CHMLib LZX Huffman decompression](https://junglewise.ai/threats/cve-2026-55586-sumatrapdf-heap-overflow-in-chmlib-lzx-huffman-decompression) (medium, CVSS 6.6, published 20 Aug 2026) - [CVE-2026-107729: SumatraPDF out-of-bounds read in MOBI header parsing](https://junglewise.ai/threats/cve-2026-107729-sumatrapdf-is-a-multi-format-reader-for-windows-in-3-7-0-22298) (medium, CVSS 5.5, published 8 Oct 2026) - [CVE-2026-107730: SumatraPDF integer overflow in LIT header parsing](https://junglewise.ai/threats/cve-2026-107730-sumatrapdf-is-a-multi-format-reader-for-windows-in-3-7-0-22298) (medium, CVSS 5.5, published 8 Oct 2026) - [CVE-2026-107731: SumatraPDF integer overflow in LIT parser range validation](https://junglewise.ai/threats/cve-2026-107731-sumatrapdf-is-a-multi-format-reader-for-windows-in-3-7-0-22298) (medium, CVSS 5.5, published 8 Oct 2026) - [CVE-2026-107802: SumatraPDF command-line argument injection in AI translation](https://junglewise.ai/threats/cve-2026-107802-sumatrapdf-is-a-multi-format-reader-for-windows-in-3-6-1-and) (info, published 8 Oct 2026) - [CVE-2026-107732: SumatraPDF command injection in notification markup](https://junglewise.ai/threats/cve-2026-107732-sumatrapdf-is-a-multi-format-reader-for-windows-in-3-6-1-and) (info, published 8 Oct 2026) - [CVE-2026-107738: SumatraPDF out-of-bounds read in CHM parser](https://junglewise.ai/threats/cve-2026-107738-sumatrapdf-is-a-multi-format-reader-for-windows-in-3-6-1-and) (info, published 8 Oct 2026) - [CVE-2026-107737: SumatraPDF out-of-bounds pointer read in its:// window lookup](https://junglewise.ai/threats/cve-2026-107737-sumatrapdf-is-a-multi-format-reader-for-windows-in-3-6-1-and) (info, published 8 Oct 2026) - [CVE-2026-107736: SumatraPDF stack buffer overflow in EXIF Orientation parsing](https://junglewise.ai/threats/cve-2026-107736-sumatrapdf-is-a-multi-format-reader-for-windows-in-3-6-1-and) (info, published 8 Oct 2026) ## Vulnerabilities per week 1 vulnerability in the last four weeks, down 91% on the four before (11). | Week of | Vulns | Critical | Exploited | | --- | --- | --- | --- | | 17 Aug 2026 | 1 | 0 | 0 | | 24 Aug 2026 | 0 | 0 | 0 | | 31 Aug 2026 | 0 | 0 | 0 | | 7 Sep 2026 | 0 | 0 | 0 | | 14 Sep 2026 | 0 | 0 | 0 | | 21 Sep 2026 | 1 | 0 | 0 | | 28 Sep 2026 | 0 | 0 | 0 | | 5 Oct 2026 | 10 | 0 | 0 | | 12 Oct 2026 | 0 | 0 | 0 | | 19 Oct 2026 | 0 | 0 | 0 | | 26 Oct 2026 | 0 | 0 | 0 | | 2 Nov 2026 | 1 | 0 | 0 | | 9 Nov 2026 | 0 | 0 | 0 | ## Sources NVD, GitHub Security Advisories, OSV, the CISA Known Exploited Vulnerabilities catalog, FIRST EPSS and vendor advisories. Rebuilt every hour. Cite as: Junglewise Threat Intelligence, "SumatraPDF vulnerabilities", https://junglewise.ai/threats/technologies/sumatrapdf, 12 November 2026.