Description

SumatraPDF is a multi-format reader for Windows. In 3.6.1 and earlier, a crafted CHM file can supply malformed LZX Huffman code lengths to make_decode_table in ext/CHMLib/lzx.c. In the long-code branch, the function writes new internal nodes through next_symbol before validating that the canonical Huffman table has overflowed. The PRETREE case can write beyond the 104-entry PRETREE_table into adjacent heap state in struct LZXstate when reached through chm_open, chm_retrieve_object, LZXdecompress, and BUILD_TABLE. This produces heap memory corruption in the parser process, while arbitrary code execution has not been demonstrated. No fixed version is available as of this review.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.6",
  "pubDate": "2026-08-20T17:18:27.723Z",
  "pubdate": "2026-08-20T17:18:27.723Z",
  "executiveSummary": "A heap memory corruption vulnerability exists in SumatraPDF version 3.6.1 and earlier, specifically within the LZX decompression component inherited from CHMLib. The flaw is triggered when a specially crafted CHM file supplies malformed LZX Huffman code lengths to the decoding logic. This results in an out-of-bounds write condition where internal nodes are written through next_symbol before validating canonical Huffman table overflow, specifically affecting the PRETREE case and overflowing the PRETREE_table within struct LZXstate. The impact of this vulnerability is heap memory corruption within the parser process. Currently, arbitrary code execution has not been demonstrated. The attack vector requires an adversary to provide a malicious CHM file to a victim for processing. No fixed version is available as of this review, increasing the operational risk for environments that process untrusted CHM documentation.",
  "technicalDetails": "The vulnerability resides in the function make_decode_table located within the file ext/CHMLib/lzx.c. The affected component is invoked during operations including chm_open, chm_retrieve_object, LZXdecompress, and BUILD_TABLE. The root cause of the vulnerability is an insufficient bounds validation sequence during the processing of canonical Huffman tables derived from LZX-compressed data streams. Specifically, when processing the long-code branch, the function writes new internal nodes via next_symbol prior to verifying whether the canonical Huffman table has overflowed its allocated boundaries. Consequently, in the PRETREE case, execution paths can write data beyond the static 104-entry PRETREE_table and into adjacent heap memory states situated within struct LZXstate. The attack flow initiates when SumatraPDF parses a malicious CHM file containing manipulated LZX Huffman code lengths. The parsing engine processes the compressed streams via the CHMLib integration, invoking LZXdecompress and subsequently passing the malicious parameters to make_decode_table and BUILD_TABLE. As the parsing routine constructs the Huffman decoding tables, the absence of prior boundary checks allows the PRETREE logic to overwrite adjacent heap metadata or state variables. This leads directly to heap memory corruption within the context of the parser process. Authentication and privilege requirements are absent, as the vulnerability is triggered locally by opening a malicious file. Network exposure is not required since exploitation relies on local file processing, though the file can be delivered via remote vectors such as web downloads or email attachments. As of this analysis, arbitrary code execution has not been demonstrated, limiting the immediate post-exploitation impact to parser process destabilization and heap corruption."
}