Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1336 CNY

100%
Buy Us a Coffee

CVE-2026-55586— SumatraPDF: Heap out-of-bounds write in vendored CHMLib LZX Huffman table construction reachable from crafted CHM files

Quick assessment

Affected
sumatrapdfreader sumatrapdf
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

SumatraPDF 是 Windows 平台上的多格式文档阅读器。在版本 3.6.1 及更早版本中，构造恶意 CHM 文件可向 ext/CHMLib/lzx.c 中的 make_decode_table 函数提供畸形的 LZX Huffman 编码长度。在 long-code 分支中，该函数在验证规范 Huffman 表是否发生溢出之前，便通过 next_symbol 写入新的内部节点。当通过 chm_open、chm_retrieve_object、LZXdecompress 和 BUILD_TABLE 等函数

CVSS 6.6 · Medium EPSS 0.13% · P3

Possible ATT&CK Techniques 1 AI

T1203 · Exploitation for Client Execution

Affected Version Matrix 1

VendorProduct Version RangeStatus
sumatrapdfreader sumatrapdf <= 3.6.1rel affected
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-55586

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
SumatraPDF: Heap out-of-bounds write in vendored CHMLib LZX Huffman table construction reachable from crafted CHM files
Source: CVE Program / CVE List V5
Vulnerability Description
SumatraPDF is a multi-format reader for Windows. In 3.6.1 and earlier, a crafted CHM file can supply malformed LZX Huffman code lengths to make_decode_table in ext/CHMLib/lzx.c. In the long-code branch, the function writes new internal nodes through next_symbol before validating that the canonical Huffman table has overflowed. The PRETREE case can write beyond the 104-entry PRETREE_table into adjacent heap state in struct LZXstate when reached through chm_open, chm_retrieve_object, LZXdecompress, and BUILD_TABLE. This produces heap memory corruption in the parser process, while arbitrary code execution has not been demonstrated. No fixed version is available as of this review.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:H/A:L
Source: CVE Program / CVE List V5
Vulnerability Type
内存缓冲区边界内操作的限制不恰当
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
sumatrapdfreader sumatrapdf <= 3.6.1rel -

II. Public POCs for CVE-2026-55586

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-55586

请登录查看更多情报信息。

Vendor Advisories for CVE-2026-55586 (1)

IV. Related Vulnerabilities

Same product: sumatrapdf
Same vendor: sumatrapdfreader
Same weakness: CWE-119

V. Comments for CVE-2026-55586

No comments yet

Leave a comment