Vulnerability · Published Oct 8, 2026 · Assigned by GitHub_M

CVE-2026-107730SumatraPDF: Signed integer overflow in the LIT header parsing causes invalid-pointer read

Medium 5.5

In plain English

A medium-severity integer overflow in sumatrapdf from sumatrapdfreader. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.1% (higher than 2% of all known vulnerabilities).

Severity (CVSS 3.1)5.5Medium

Exploit odds (30 days)0.1%top 98.0% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

SumatraPDF is a multi-format reader for Windows. In 3.7.0.22298, LitParseHeader() in src/LitDoc.cpp computes the attacker-controlled hdrLen + nPieces * 16 section offset using signed 32-bit arithmetic without validating the complete result. When the component values make that aggregate calculation overflow to a negative value, pointer construction reaches an invalid read in LitU32(), causing deterministic application termination. The supplied evidence does not demonstrate code execution, information disclosure, arbitrary read, or integrity impact. No fixed version is available as of this review.

Affected products (as reported)

Vendor	Product	Versions
sumatrapdfreader	sumatrapdf	<= 3.7.0.22298

Weakness: CWE-190 · Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

References

https://github.com/sumatrapdfreader/sumatrapdf/security/advisories/GHSA-vfpj-qhvj-92wg x_refsource_CONFIRM
https://github.com/sumatrapdfreader/sumatrapdf/commit/10a83278a5a6f67194dedfb67c47474d22ecfe4b x_refsource_MISC