CVE-2026-107737

SumatraPDF is a multi-format reader for Windows. In 3.6.1 and earlier, and in pre-release 3.7.0.20369 when WebView2 is absent or cannot initialize, ParseProtoUrl() accepts the signed host component of an its:// URL and FindHtmlWindowById() uses it directly as an index into gHtmlWindows. Opening a crafted CHM through the IE fallback backend with a negative or otherwise out-of-range window identifier can cause an out-of-bounds pointer read followed by an invalid object callback dereference and process termination. No fixed version is available as of this review.

• CWE-129

• https://github.com/sumatrapdfreader/sumatrapdf/commit/596c7e26e983549a77a3a38cae1147ab73792929
• https://github.com/sumatrapdfreader/sumatrapdf/security/advisories/GHSA-8p34-f32f-7rmq

Published

Oct 8, 2026

Last Modified

Oct 8, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-107731SumatraPDF is a multi-format reader for Windows. In 3.7.0.22…5.5
• CVE-2026-107732SumatraPDF is a multi-format reader for Windows. In 3.6.1 an…8.4
• CVE-2026-107733SumatraPDF is a multi-format reader for Windows. In 3.6.1 an…6.8
• CVE-2026-107734SumatraPDF is a multi-format reader for Windows. In 3.5.2 an…7.1
• CVE-2026-107735SumatraPDF is a multi-format reader for Windows. In 3.6.1 an…5.4
• CVE-2026-107736SumatraPDF is a multi-format reader for Windows. In 3.6.1 an…6.8
• CVE-2026-107738SumatraPDF is a multi-format reader for Windows. In 3.6.1 an…6.8
• CVE-2026-10774Zephyr's Bluetooth Mesh subnet key management leaks one PSA …6.5
• CVE-2026-10775A vulnerability was determined in sgl-project SGLang up to 0…5.3
• CVE-2026-10777A vulnerability was identified in ealpha072 Student-Manageme…7.3
• CVE-2026-107778MIT Kerberos 5 (krb5) through 1.22.2 contains a NULL pointer…6.5
• CVE-2026-107779Dromara Skyeye through commit 003549ae5615bd114ba5bb8ddf6a8e…9.8