Vulnerability · Published Oct 8, 2026 · Assigned by GitHub_M

CVE-2026-107736SumatraPDF: stack buffer overflow while processing EXIF Orientation metadata

Medium 6.8

In plain English

A medium-severity stack buffer overflow in sumatrapdf from sumatrapdfreader. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.1% (higher than 2% of all known vulnerabilities).

Severity (CVSS 4.0)6.8Medium

Exploit odds (30 days)0.1%top 98.2% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

SumatraPDF is a multi-format reader for Windows. In 3.6.1 and earlier, MaybeFlipBitmap() asks GDI+ to read the attacker-controlled PropertyTagOrientation size through GetPropertyItem() while supplying only a fixed 64-byte buf on the stack. Opening a crafted TIFF with enough EXIF Orientation values can cause attacker-selected bytes to overwrite stack control data, while tested builds terminate through the stack cookie check. No broader impact is claimed beyond the advisory-supported conditions. No fixed version is available as of this review.

Affected products (as reported)

Vendor	Product	Versions
sumatrapdfreader	sumatrapdf	<= 3.6.1

Weakness: CWE-121 · Vector: CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

References

https://github.com/sumatrapdfreader/sumatrapdf/security/advisories/GHSA-px68-7vwv-mxpr x_refsource_CONFIRM
https://github.com/sumatrapdfreader/sumatrapdf/commit/6fe2e0239d8ef3466174ac92f3f56e967ce1a4a7 x_refsource_MISC