CVE-2026-55586: 
SumatraPDF vulnerability analysis and mitigation

CVE-2026-55586 is a heap out-of-bounds write vulnerability in SumatraPDF's vendored CHMLib LZX decompressor, reachable by opening a crafted .chm file. It affects SumatraPDF version 3.6.1 and earlier on Windows. The flaw resides in make_decode_table() within ext/CHMLib/lzx.c, where malformed LZX Huffman code lengths can cause writes beyond the bounds of the PRETREE_table array into adjacent heap memory. It was published on August 20, 2026, with a CVSS v3.1 base score of 6.6 (Medium) (GitHub Advisory).

The root cause is an out-of-bounds write (CWE-787) combined with improper restriction of memory buffer operations (CWE-119) in make_decode_table(). In the long-code branch, the function writes new internal Huffman decode-table nodes via table[(next_symbol << 1)] and table[(next_symbol << 1) + 1] before checking whether the canonical Huffman table has overflowed. For the PRETREE case, the table is statically sized at 104 UWORD entries ((1 << 6) + (20 << 1)); with crafted PRETREE code lengths, next_symbol advances past index 103, writing zero values into adjacent fields of the heap-allocated struct LZXstate (specifically into PRETREE_len[]). The vulnerable call chain is: chm_open() → chm_retrieve_object() → _chm_decompress_region() → _chm_decompress_block() → LZXdecompress() → BUILD_TABLE(PRETREE) → make_decode_table(). A PoC including a crafted CHM generator (make_evil_chm.py) and GDB observation scripts was included in the advisory (GitHub Advisory).

Successful exploitation causes reliable heap memory corruption within the SumatraPDF parser process when a user opens a malicious .chm file. The demonstrated primitive produces multiple intra-struct out-of-bounds zero writes into PRETREE_len[] adjacent to PRETREE_table[], corrupting internal decompressor state. Arbitrary code execution has not been demonstrated, but the advisory notes a plausible path to stronger exploitation depending on heap layout and whether MAINTREE/LENGTH table variants can be weaponized. A secondary information disclosure primitive was also observed: after a failed decompression, a follow-up chm_retrieve_object() call may return data from CHMLib's internal cache (GitHub Advisory).

A proof-of-concept is publicly available as part of the GitHub Security Advisory, including a crafted CHM file generator, a CHMLib consumer harness, and GDB observation scripts that confirm the out-of-bounds writes. Exploitation requires user interaction — a victim must open a malicious .chm file with SumatraPDF. No in-the-wild exploitation has been reported, no threat actor attribution exists, and the EPSS score is 0.0. The vulnerability is not listed in the CISA KEV catalog (GitHub Advisory).

1. Craft a malicious CHM file: Use the provided make_evil_chm.py script (or equivalent) to generate a .chm file containing a compressed object with malformed LZX PRETREE Huffman code lengths (e.g., all 20 PRETREE symbols assigned length 15), which will cause next_symbol to overflow the 104-entry PRETREE_table.
2. Deliver the file to the target: Social-engineer the victim into downloading or receiving the crafted .chm file via email, web download, or file share.
3. Trigger parsing: The victim opens the .chm file with SumatraPDF (version ≤ 3.6.1). SumatraPDF calls chm_open() on the file, which succeeds.
4. Trigger decompression: SumatraPDF calls chm_retrieve_object() to retrieve a compressed object, which internally calls LZXdecompress() → BUILD_TABLE(PRETREE) → make_decode_table().
5. Out-of-bounds writes occur: make_decode_table() writes zero values to table[104] through table[115+] (and their +1 counterparts), corrupting the adjacent PRETREE_len[] field inside struct LZXstate on the heap. LZXdecompress() subsequently returns DECR_ILLEGALDATA.
6. Potential further exploitation: Depending on heap layout, an attacker may attempt to leverage the corruption of adjacent heap state for further primitives (e.g., targeting MAINTREE or LENGTH table variants for a more impactful write) to escalate toward code execution (GitHub Advisory).

• File System: Presence of unexpected or unsolicited .chm files in user download directories, temp folders, or email attachment staging areas.
• Process: SumatraPDF process (SumatraPDF.exe) crashing or terminating abnormally shortly after opening a .chm file; crash dumps referencing lzx.c or make_decode_table in the call stack.
• Logs: Windows Event Log entries (Application log) showing faulting module SumatraPDF.exe with exception code 0xC0000005 (access violation) or similar memory corruption exceptions after CHM file access.
• Network: Unexpected outbound network connections from SumatraPDF.exe following CHM file opening (would indicate successful code execution beyond the demonstrated primitive).

A fix has been committed to the SumatraPDF repository (commit 13b3d42) that adds a bounds check on next_symbol in make_decode_table() before writing internal decode-table nodes, rejecting malformed PRETREE length streams safely (GitHub Commit). As of the advisory publication date, no fixed release version was available. Users should monitor the SumatraPDF releases page for a patched build incorporating this commit. As a workaround, avoid opening .chm files from untrusted sources with SumatraPDF until a patched release is available, and consider using an alternative CHM viewer for untrusted files.

The vulnerability was reported by researcher aramosf and published via GitHub Security Advisory by the SumatraPDF maintainer (kjk) on June 14, 2026, with a Moderate severity rating. The advisory includes a detailed PoC and GDB observation output, reflecting a thorough disclosure. No significant broader media coverage or notable community commentary beyond the advisory itself has been identified at this time (GitHub Advisory).