PT-2026-108304 · Unknown · Sumatrapdf
CVE-2026-107736
·
Published
2026-10-08
·
Updated
2026-10-08
CVSS v4.0
6.8
Medium
| Vector | AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X |
Name of the Vulnerable Software and Affected Versions
SumatraPDF versions prior to 3.6.2
Description
The
MaybeFlipBitmap() function uses GetPropertyItem() to read the PropertyTagOrientation size via GDI+ into a fixed 64-byte buffer on the stack. An attacker can trigger a stack-based buffer overflow by providing a crafted TIFF file containing excessive EXIF Orientation values, allowing the overwrite of stack control data. In tested builds, this typically results in application termination due to the stack cookie check.Recommendations
At the moment, there is no information about a newer version that contains a fix for this vulnerability.
Exploit
Stack Overflow
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Sumatrapdf