{"id":"CVE-2026-107731","summary":"SumatraPDF: LIT parser range-validation flaws cause invalid-pointer reads and denial of service","details":"SumatraPDF is a multi-format reader for Windows. In 3.7.0.22298, four independently reachable range-validation variants in src/LitDoc.cpp allow file-controlled offsets and sizes to overflow, narrow to negative values, or wrap before incomplete bounds checks. The affected calculations include contentOffset, the directory expression dirOff64 + dirLen64, and the decoded-section offset + size, along with secondary-header range handling. Opening a crafted LIT file that reaches one of these variants can cause invalid pointer reads and deterministic application termination. No broader impact is claimed beyond the advisory-supported conditions. No fixed version is available as of this review.","aliases":["GHSA-753j-hx3p-xm9g"],"modified":"2026-10-11T07:05:42.436140473Z","published":"2026-10-08T22:20:36.456Z","database_specific":{"unresolved_ranges":[{"extracted_events":[{"last_affected":"3.7.0.22298"}],"source":"AFFECTED_FIELD"}],"cna_assigner":"GitHub_M","cwe_ids":["CWE-125"],"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/107xxx/CVE-2026-107731.json"},"references":[{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/107xxx/CVE-2026-107731.json"},{"type":"ADVISORY","url":"https://github.com/sumatrapdfreader/sumatrapdf/security/advisories/GHSA-753j-hx3p-xm9g"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-107731"},{"type":"FIX","url":"https://github.com/sumatrapdfreader/sumatrapdf/commit/5d43b8cf9c45335ffd47e616bfa27648f17d0b63"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/sumatrapdfreader/sumatrapdf","events":[{"introduced":"0"},{"fixed":"5d43b8cf9c45335ffd47e616bfa27648f17d0b63"}],"database_specific":{"source":"REFERENCES"}}],"versions":["3.2","3.1.2rel","3.0split","2.5split","2.4split","2.3split","2.2split","2.1split","2.0split","1.9split","1.8split","1.7split","1.6split","1.5split","1.4split"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-107731.json","vanir_signatures":[{"source":"https://github.com/sumatrapdfreader/sumatrapdf/commit/5d43b8cf9c45335ffd47e616bfa27648f17d0b63","target":{"file":"src/LitDoc.cpp"},"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["199205563203602812905179813470164485789","114162473631975974223061983053246634010","247711048815982717341300530188999003867","22962730332751337008960268087675161122","69045933242131309633373178711531261601","12019759525677462936414752264411881497","135625614226657014038051803743681859702","143197830241847192226314465781220065624","233190698685059265404056592970904119746","60450460576439584763547167152351412932","288348184348546888570889354586478788698","252625065050707041726140544214404010679","161399777398429601936607758602393138328","183356153385104789065310578159408060157","19944108141968818271877230445711897370","149797784381738975947357939284508564388","86406105826872408109643188621323672880","46708814831879881988690233523350751112","149097797879677839863870023873001830027","35715024114143578866839847003870816000","313745387739587936264750075847102350214","245230161956414297076233666856418221814","211418141539333844232688651155682654985","105501946065125232075922994207269066454","171623483831486861086880140518854474972","227248928901520769466285383789559868901","236640662783539138926306630392814903736","124908651749981721351144818880149663104","13354031986028584379537047601640196411","144832003275819838512778367125052486214","328973707903669504317469231200361639263","189064542709236961190098475675665138843","65146143688245224876147791383350867590","238063199276707297660223156286810383826","295735428235598589703331892361995997280","274315707661010806806584134740811855251","71507140679455502814792577532471686788","5931833898531959789214682915853405866","85841133779497758438548977965851329208","190874374741940102158554750423480054673","143229976321017937676665163843735720343","89752049218195465367347118449795635317","8124948932583268588060943595962517135","22331619182791308160666680948650145082"]},"id":"CVE-2026-107731-008301e2","signature_type":"Line","signature_version":"v1"},{"signature_version":"v1","source":"https://github.com/sumatrapdfreader/sumatrapdf/commit/5d43b8cf9c45335ffd47e616bfa27648f17d0b63","target":{"file":"src/LitDoc.cpp","function":"LitFile::GetSection"},"deprecated":false,"digest":{"length":1965,"function_hash":"66910474662412699205289824710153147285"},"id":"CVE-2026-107731-48b588af","signature_type":"Function"},{"target":{"file":"src/LitDoc.cpp","function":"LitLzxDecompress"},"deprecated":false,"digest":{"function_hash":"120730684085809537246841221885040755081","length":1874},"id":"CVE-2026-107731-503a9681","signature_type":"Function","signature_version":"v1","source":"https://github.com/sumatrapdfreader/sumatrapdf/commit/5d43b8cf9c45335ffd47e616bfa27648f17d0b63"},{"signature_version":"v1","source":"https://github.com/sumatrapdfreader/sumatrapdf/commit/5d43b8cf9c45335ffd47e616bfa27648f17d0b63","target":{"file":"src/LitDoc.cpp","function":"LitParseAtoms"},"deprecated":false,"digest":{"length":902,"function_hash":"340246948208547747915095689376150550350"},"id":"CVE-2026-107731-6821d7bb","signature_type":"Function"},{"id":"CVE-2026-107731-aeecb286","signature_type":"Function","signature_version":"v1","source":"https://github.com/sumatrapdfreader/sumatrapdf/commit/5d43b8cf9c45335ffd47e616bfa27648f17d0b63","target":{"function":"LitFile::GetFile","file":"src/LitDoc.cpp"},"deprecated":false,"digest":{"function_hash":"287206958305922616779187370530518158464","length":478}},{"source":"https://github.com/sumatrapdfreader/sumatrapdf/commit/5d43b8cf9c45335ffd47e616bfa27648f17d0b63","target":{"file":"src/LitDoc.cpp","function":"LitParseHeader"},"deprecated":false,"digest":{"function_hash":"43904452559058013761059271511514226578","length":2815},"id":"CVE-2026-107731-b63ee0a7","signature_type":"Function","signature_version":"v1"}],"vanir_signatures_modified":"2026-10-11T07:05:42Z"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H"}]}