What’s Vulnerable › Vulnerabilities

CVE-2026-107736: SumatraPDF: stack buffer overflow while processing EXIF Orientation metadata

• Severity: medium (CVSS 6.8 v4.0)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.1% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-10-08 · updated 2026-10-09
• Weakness: CWE-121

Description

SumatraPDF is a multi-format reader for Windows. In 3.6.1 and earlier, MaybeFlipBitmap() asks GDI+ to read the attacker-controlled PropertyTagOrientation size through GetPropertyItem() while supplying only a fixed 64-byte buf on the stack. Opening a crafted TIFF with enough EXIF Orientation values can cause attacker-selected bytes to overwrite stack control data, while tested builds terminate through the stack cookie check. No broader impact is claimed beyond the advisory-supported conditions. No fixed version is available as of this review.

Affected products

• sumatrapdfreader sumatrapdf: through 3.6.1

References

• https://github.com/sumatrapdfreader/sumatrapdf/commit/6fe2e0239d8ef3466174ac92f3f56e967ce1a4a7
• https://github.com/sumatrapdfreader/sumatrapdf/security/advisories/GHSA-px68-7vwv-mxpr

Get alerted when CVE-2026-107736 or the next vulnerability affects your stack