Soon57Medium5.7VulnerabilityCVE-2026-107737No patch link observed

CVE-2026-107737 — SumatraPDF is a multi-format reader for Windows.

Published Oct 8, 2026, 11:16 PM UTCIngested 48m agoSource NVD(cve-db)CVE-2026-107737

Description

SumatraPDF is a multi-format reader for Windows. In 3.6.1 and earlier, and in pre-release 3.7.0.20369 when WebView2 is absent or cannot initialize, ParseProtoUrl() accepts the signed host component of an its:// URL and FindHtmlWindowById() uses it directly as an index into gHtmlWindows. Opening a crafted CHM through the IE fallback backend with a negative or otherwise out-of-range window identifier can cause an out-of-bounds pointer read followed by an invalid object callback dereference and process termination. No fixed version is available as of this review.

CVSS v4.0 base metrics

CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

5.7

Medium severity

Band computed from the CVSS base score, not the source's own label — so it means the same thing across every feed.

Local

Attack Vector

Low

Attack Complexity

Present

Attack Requirements

None

Privileges Required

Passive

User Interaction

None

Confidentiality (Vulnerable System)

None

Integrity (Vulnerable System)

High

Availability (Vulnerable System)

None

Confidentiality (Subsequent System)

None

Integrity (Subsequent System)

None

Availability (Subsequent System)

References

Related threats

same CWE or vendor

High

CVE-2026-107325 — Improper validation of a BSON array length in the MongoDB Go Driver can cause an out-of-bounds index and runtime panic when an application calls bs…

CVE-2026-107325 · 7h ago

Medium

CVE-2026-107225 — Excelize is a Go language library for reading and writing Microsoft Excel spreadsheets.

CVE-2026-107225 · 1d ago

Medium

CVE-2026-107222 — Excelize is a Go language library for reading and writing Microsoft Excel spreadsheets.

CVE-2026-107222 · 1d ago

Medium

CVE-2026-107220 — Excelize is a Go language library for reading and writing Microsoft Excel spreadsheets.

CVE-2026-107220 · 1d ago

Medium

CVE-2026-107218 — Excelize is a Go language library for reading and writing Microsoft Excel spreadsheets.

CVE-2026-107218 · 1d ago

High

CVE-2026-107217 — Excelize is a Go language library for reading and writing Microsoft Excel spreadsheets.

CVE-2026-107217 · 1d ago