CVE-2026-55586 sumatrapdfreader CVE debrief

Who should care

Defenders responsible for managing and securing document readers, particularly those using SumatraPDF, should assess exposure and prioritize verification and mitigation. They should verify versions, restrict CHM file processing, and implement memory protections. Defenders should also review and limit file parsing and processing.

Why it matters

CVE-2026-55586 is a medium-severity vulnerability in SumatraPDF 3.6.1 and earlier, allowing crafted CHM files to cause heap memory corruption. Defenders should verify versions, restrict CHM file processing, and implement memory protections.

• Potential heap memory corruption in the parser process
• Requires verification of SumatraPDF versions and CHM file processing restrictions
• May necessitate implementing memory corruption protections and monitoring

Technical summary

In SumatraPDF 3.6.1 and earlier, a crafted CHM file can supply malformed LZX Huffman code lengths to make_decode_table in ext/CHMLib/lzx.c, leading to heap memory corruption in the parser process. The PRETREE case can write beyond the 104-entry PRETREE_table into adjacent heap state in struct LZXstate when reached through chm_open, chm_retrieve_object, LZXdecompress, and BUILD_TABLE. This produces heap memory corruption in the parser process, while arbitrary code execution has not been demonstrated. No fixed version is available as of this review.

Defensive priority

Defenders should prioritize verifying SumatraPDF versions and restricting CHM file processing to mitigate potential heap corruption.

Recommended defensive actions

• Verify SumatraPDF version and restrict CHM file processing
• Implement memory corruption protections and monitoring
• Review and limit file parsing and processing
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance.
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed.
• Check relevant monitoring, detection, and logs for exposed assets that need extra review.

Evidence notes

The CVE record and NVD entry provide details on the vulnerability, but no fixed version is available. SumatraPDF's official repository and GitHub advisories offer additional context. The vulnerability has not been demonstrated to allow arbitrary code execution. Defenders should verify versions, restrict CHM file processing, and implement memory protections. The CVE record was published on 2026-08-20T17:18:27.723Z and has not been modified since then. The vulnerability affects SumatraPDF 3.6.1 and earlier.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.