Out-of-Bounds Read in SumatraPDF Affected by Absence of WebView2

CVE-2026-107737

What is CVE-2026-107737?

In SumatraPDF versions 3.6.1 and earlier, as well as the pre-release of 3.7.0.20369, a security vulnerability exists when WebView2 is either absent or fails to initialize. The function ParseProtoUrl() processes the signed host component of an its:// URL, which can lead to FindHtmlWindowById() referencing it directly as an index into gHtmlWindows. This situation arises when a manipulated CHM file is opened through the Internet Explorer fallback backend, thus causing a negative or out-of-range window identifier. The result is an out-of-bounds pointer read leading to an invalid object callback dereference and can ultimately result in the termination of the process. As of this writing, no fixed version has been released to address this vulnerability.

References