CVE-2026-107730

SumatraPDF is a multi-format reader for Windows. In 3.7.0.22298, LitParseHeader() in src/LitDoc.cpp computes the attacker-controlled hdrLen + nPieces * 16 section offset using signed 32-bit arithmetic without validating the complete result. When the component values make that aggregate calculation overflow to a negative value, pointer construction reaches an invalid read in LitU32(), causing deterministic application termination. The supplied evidence does not demonstrate code execution, information disclosure, arbitrary read, or integrity impact. No fixed version is available as of this review.

• CWE-190

• https://github.com/sumatrapdfreader/sumatrapdf/commit/10a83278a5a6f67194dedfb67c47474d22ecfe4b
• https://github.com/sumatrapdfreader/sumatrapdf/security/advisories/GHSA-vfpj-qhvj-92wg

Published

Oct 8, 2026

Last Modified

Oct 9, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-107725Hazelcast is a unified real-time data platform combining str…8.7
• CVE-2026-107726Hazelcast is a unified real-time data platform combining str…9.3
• CVE-2026-107727Strawberry GraphQL is a library for creating GraphQL APIs. F…3.7
• CVE-2026-107728Strawberry GraphQL is a library for creating GraphQL APIs. F…7.5
• CVE-2026-107729SumatraPDF is a multi-format reader for Windows. In 3.7.0.22…5.5
• CVE-2026-10773The DHCPv4 client helper net_dhcpv4_msg_type_name() in subsy…5.4
• CVE-2026-107731SumatraPDF is a multi-format reader for Windows. In 3.7.0.22…5.5
• CVE-2026-107732SumatraPDF is a multi-format reader for Windows. In 3.6.1 an…8.4
• CVE-2026-107733SumatraPDF is a multi-format reader for Windows. In 3.6.1 an…6.8
• CVE-2026-107734SumatraPDF is a multi-format reader for Windows. In 3.5.2 an…7.1
• CVE-2026-107735SumatraPDF is a multi-format reader for Windows. In 3.6.1 an…5.4
• CVE-2026-107736SumatraPDF is a multi-format reader for Windows. In 3.6.1 an…6.8