CVE-2026-55586: sumatrapdfreader sumatrapdf

Vulnerability summary

CVE-2026-55586 is a medium (CVSS 6.6) vulnerability in sumatrapdfreader sumatrapdf. EPSS estimates a 0.17% chance of exploitation in the next 30 days, higher than 6.5% of scored vulnerabilities.

Timeline

1. 20-08-2026
   PublishedVulnerability first disclosed.
2. 21-08-2026
   Last modifiedVulnerability information updated.

Description

SumatraPDF is a multi-format reader for Windows. In 3.6.1 and earlier, a crafted CHM file can supply malformed LZX Huffman code lengths to make_decode_table in ext/CHMLib/lzx.c. In the long-code branch, the function writes new internal nodes through next_symbol before validating that the canonical Huffman table has overflowed. The PRETREE case can write beyond the 104-entry PRETREE_table into adjacent heap state in struct LZXstate when reached through chm_open, chm_retrieve_object, LZXdecompress, and BUILD_TABLE. This produces heap memory corruption in the parser process, while arbitrary code execution has not been demonstrated. No fixed version is available as of this review.

• CWE-119Improper Restriction of Operations within the Bounds of a Memory BufferThe product performs operations on a memory buffer, but it reads from or writes to a memory location outside the buffer's intended boundary. This may result in read or write operations on unexpected memory locations that could be linked to other variables, data structures, or internal program data.
• CWE-787Out-of-bounds WriteThe product writes data past the end, or before the beginning, of the intended buffer.