Integer Overflow in SumatraPDF PDF PageLabels Parsing

Executive Summary

SumatraPDF 3.6.1 has an integer overflow vulnerability in the function EngineMupdf::BuildPageLabelRec() when processing PDF PageLabels /Nums entries. An attacker can exploit this by setting a /Nums key to INT_MAX (2147483647), causing an overflow when adding 1 to the value. This leads to undefined behavior and potential crashes, especially in builds with undefined behavior sanitizers.

Useful 0 Not Useful 0

Detection Guidance

To detect this vulnerability, monitor for crashes in SumatraPDF when processing PDFs with PageLabels /Nums keys set to INT_MAX. Check application logs for SIGILL signals in builds with undefined behavior sanitizers. Inspect PDFs for malicious PageLabels entries using tools like pdfinfo or custom scripts parsing PDF structure.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability could allow an attacker to crash SumatraPDF or other mupdf-based viewers by providing a malicious PDF with a specially crafted PageLabels /Nums key. The crash occurs due to integer overflow leading to undefined behavior, which may trigger SIGILL signals in certain builds.

Useful 0 Not Useful 0

Mitigation Strategies

Update SumatraPDF to the latest patched version that addresses the integer overflow in BuildPageLabelRec(). If using mupdf-based viewers, ensure they include the fix for CVE-2026-88361. Avoid opening untrusted PDFs, especially those with PageLabels /Nums keys. Implement network-level controls to block or quarantine suspicious PDF files.

Useful 0 Not Useful 0