Vulnerability Description
SumatraPDF is a multi-format reader for Windows. In 3.6.1 and earlier, a crafted CHM file can supply malformed LZX Huffman code lengths to make_decode_table in ext/CHMLib/lzx.c. In the long-code branch, the function writes new internal nodes through next_symbol before validating that the canonical Huffman table has overflowed. The PRETREE case can write beyond the 104-entry PRETREE_table into adjacent heap state in struct LZXstate when reached through chm_open, chm_retrieve_object, LZXdecompress, and BUILD_TABLE. This produces heap memory corruption in the parser process, while arbitrary code execution has not been demonstrated. No fixed version is available as of this review.
CVSS Score
MEDIUM
Related Weaknesses (CWE)
References
- https://github.com/sumatrapdfreader/sumatrapdf/commit/13b3d4204dd12d93d426f2157b
- https://github.com/sumatrapdfreader/sumatrapdf/security/advisories/GHSA-m423-rp8
FAQ
What is CVE-2026-55586?
CVE-2026-55586 is a vulnerability with a CVSS score of 6.6 (MEDIUM). SumatraPDF is a multi-format reader for Windows. In 3.6.1 and earlier, a crafted CHM file can supply malformed LZX Huffman code lengths to make_decode_table in ext/CHMLib/lzx.c. In the long-code branc...
How severe is CVE-2026-55586?
CVE-2026-55586 has been rated MEDIUM with a CVSS base score of 6.6/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2026-55586?
Check the references section above for vendor advisories and patch information. Review vendor security bulletins for remediation guidance.