CVE-2026-107736

Deferred Deferred - Pending Action

Stack-Based Buffer Overflow in SumatraPDF via Malicious TIFF File

Publication date: 2026-10-08

Last updated on: 2026-10-08

Assigner: GitHub, Inc.

Description

SumatraPDF is a multi-format reader for Windows. In 3.6.1 and earlier, MaybeFlipBitmap() asks GDI+ to read the attacker-controlled PropertyTagOrientation size through GetPropertyItem() while supplying only a fixed 64-byte buf on the stack. Opening a crafted TIFF with enough EXIF Orientation values can cause attacker-selected bytes to overwrite stack control data, while tested builds terminate through the stack cookie check. No broader impact is claimed beyond the advisory-supported conditions. No fixed version is available as of this review.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-08

Last Modified

2026-10-08

Generated

2026-10-09

AI Q&A

2026-10-09

EPSS Evaluated

N/A

NVD

CVE-2026-107736

Affected Vendors & Products

Vendor	Product	Version / Range
sumatrapdfreader	sumatrapdf	<= 3.6.1

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-121	A stack-based buffer overflow condition is a condition where the buffer being overwritten is allocated on the stack (i.e., is a local variable or, rarely, a parameter to a function).

Attack-Flow Graph

Executive Summary

SumatraPDF versions 3.6.1 and earlier contain a vulnerability where the MaybeFlipBitmap() function uses a fixed 64-byte stack buffer to read attacker-controlled EXIF Orientation values from a crafted TIFF file via GDI+ GetPropertyItem(). This can lead to stack-based buffer overflow, potentially overwriting control data.

Detection Guidance

This vulnerability can be detected by checking for SumatraPDF versions 3.6.1 and earlier. Inspect installed software versions and scan for TIFF files with unusual EXIF Orientation metadata. No specific commands are provided in the context.

Impact Analysis

An attacker could exploit this to execute arbitrary code on your system by tricking you into opening a malicious TIFF file. This may allow full control over your computer, including data theft or installation of malware.

Compliance Impact

This vulnerability does not explicitly affect compliance with standards like GDPR or HIPAA based on the provided CVE details. The issue is limited to a stack-based buffer overflow in SumatraPDF when processing crafted TIFF files, with no broader impact claimed beyond the advisory conditions.

Mitigation Strategies

Immediately stop using SumatraPDF versions 3.6.1 and earlier. Avoid opening untrusted TIFF files. No fixed version is available, so consider alternative PDF readers until a patch is released.

Hi! I’m here to help you understand CVE-2026-107736. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70