CVE-2026-55586 sumatrapdfreader CVE debrief

Who should care

Users of SumatraPDF reader, especially those handling CHM files from untrusted sources, should be aware of this potential vulnerability and take defensive measures. This includes reviewing and updating SumatraPDF reader to a fixed version when available, implementing compensating controls such as restricting access to untrusted CHM files, and monitoring for suspicious activity related to crafted CHM files. IT and security teams responsible for managing and securing SumatraPDF reader deployments should prioritize this vulnerability and plan for timely remediation.

Technical summary

In SumatraPDF reader 3.6.1 and earlier, a crafted CHM file can cause heap memory corruption in the parser process by supplying malformed LZX Huffman code lengths. This occurs when the function writes new internal nodes through next_symbol before validating that the canonical Huffman table has overflowed. The PRETREE case can write beyond the 104-entry PRETREE_table into adjacent heap state in struct LZXstate when reached through chm_open, chm_retrieve_object, LZXdecompress, and BUILD_TABLE. While arbitrary code execution has not been demonstrated, the potential for memory corruption poses a significant risk to SumatraPDF reader users.

Defensive priority

Medium-priority defensive review recommended due to potential heap memory corruption in SumatraPDF reader.

Recommended defensive actions

• Review and update SumatraPDF reader to a fixed version when available
• Implement compensating controls such as restricting access to untrusted CHM files
• Monitor for suspicious activity related to crafted CHM files
• Perform a thorough review of SumatraPDF reader's CHM file handling and heap memory management
• Conduct additional testing with various CHM file structures to assess vulnerability impact
• Inventory and track SumatraPDF reader deployments in managed environments
• Review change management processes for timely application of SumatraPDF reader updates

Evidence notes

Evidence from official CVE and NVD sources indicates potential heap memory corruption in SumatraPDF reader when processing crafted CHM files. Limited evidence of arbitrary code execution. Further review of SumatraPDF reader versions and configurations is recommended to assess the full scope of vulnerability. Defenders should verify CHM file handling and heap memory management in the reader. Additional testing with various CHM file structures may be necessary to fully understand the vulnerability's impact.

Official resources