SumatraPDF versions 3.6.1 and earlier contain a heap buffer overflow vulnerability in the LZX decompression code used for CHM files. Specifically, malformed LZX Huffman code lengths can cause the make_decode_table function in ext/CHMLib/lzx.c to write new internal nodes beyond the 104-entry PRETREE_table buffer into adjacent heap memory within the LZXstate structure. This occurs because the function writes through next_symbol before validating that the canonical Huffman table has overflowed. The vulnerability can be triggered via the chm_open, chm_retrieve_object, LZXdecompress, and BUILD_TABLE code paths. Although this leads to heap memory corruption, no public proof of arbitrary code execution exploitation exists. No patch or remediation has been published as of the review date.

The vulnerability causes heap memory corruption in the SumatraPDF parser process when opening specially crafted CHM files. This can lead to application instability or crashes (availability impact) and may allow an attacker to manipulate internal memory structures (integrity impact). Confidentiality impact is low. There is no evidence of arbitrary code execution exploitation in the wild or demonstrated by researchers.

No official fix or patch is currently available for this vulnerability. Users should avoid opening untrusted or suspicious CHM files with affected versions of SumatraPDF. Monitor vendor advisories for updates or patches. Since this is a local attack vector requiring user interaction, exercising caution with file sources reduces risk.