CVE-2026-55586: CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer in sumatrapdfreader sumatrapdf

CVE-2026-55586 is a heap memory corruption vulnerability in SumatraPDF (<=3.6.1) caused by improper bounds checking in the LZX decompression code for CHM files. Specifically, malformed LZX Huffman code lengths can trigger out-of-bounds writes beyond the 104-entry PRETREE_table into adjacent heap memory within the LZXstate structure. This occurs in the make_decode_table function in ext/CHMLib/lzx.c during the PRETREE case when processing crafted CHM files. The vulnerability can be reached through functions such as chm_open, chm_retrieve_object, LZXdecompress, and BUILD_TABLE. Although heap corruption occurs, no public exploit or arbitrary code execution has been confirmed. No patch or fixed version is available as of the latest review.

The vulnerability causes heap memory corruption in the SumatraPDF process when parsing specially crafted CHM files. This can lead to application instability or crashes. While the CVSS score indicates low confidentiality impact, high integrity impact, and low availability impact, arbitrary code execution has not been demonstrated or confirmed. There are no known exploits in the wild.

No official fix or patch is currently available for this vulnerability. Users should avoid opening untrusted or suspicious CHM files with affected versions of SumatraPDF (3.6.1 and earlier) until a vendor update is released. Monitor the vendor advisory for future remediation guidance.