CVE-2026-107731 sumatrapdfreader CVE debrief

Who should care

Defenders and administrators of SumatraPDF 3.7.0.22298 should assess exposure to crafted LIT files, prioritize verification of range-validation flaws in src/LitDoc.cpp, and monitor for potential denial of service and invalid-pointer read impacts. They should also verify the presence of these flaws, review compensating controls, and track exceptions to ensure application integrity and security. This includes reviewing relevant monitoring, detection, and

Why it matters

CVE-2026-107731 allows denial of service and invalid-pointer reads in SumatraPDF 3.7.0.22298 through range-validation flaws; defenders should assess exposure, prioritize verification, and monitor for crafted LIT files.

• Denial of service through crafted LIT files
• Invalid-pointer reads requiring verification
• Range-validation flaws requiring patching
• Exposure assessment and monitoring priority

Technical summary

Four independently reachable range-validation variants in src/LitDoc.cpp allow file-controlled offsets and sizes to overflow, narrow to negative values, or wrap before incomplete bounds checks. These variants impact contentOffset, directory expression dirOff64 + dirLen64, decoded-section offset + size, and secondary-header range handling, causing invalid pointer reads and deterministic application termination when a crafted LIT file is opened. Defenders should focus on verifying these flaws, assessing exposure, and monitoring for potential attacks. The affected calculations include contentOffset, which can lead to denial of service and invalid-pointer reads in SumatraPDF 3.7.0.22298.

Defensive priority

Assess exposure, prioritize verification, and monitor for crafted LIT files

Recommended defensive actions

• Assess exposure to crafted LIT files in SumatraPDF 3.7.0.22298
• Prioritize verification of range-validation flaws in src/LitDoc.cpp
• Monitor for and restrict crafted LIT files
• Verify vendor remediation status
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented

Evidence notes

Official CVE Program record and NVD vulnerability detail provide information on range-validation variants in src/LitDoc.cpp, allowing file-controlled offsets and sizes to overflow, narrow to negative values, or wrap before incomplete bounds checks.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.