CVE-2026-55586

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-55586
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-55586.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-55586
Aliases
  • GHSA-m423-rp8p-whj8
Published
2026-08-20T16:35:07.359Z
Modified
2026-08-24T03:59:15.782040Z
Severity
  • 6.6 (Medium) CVSS_V3 - CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:H/A:L CVSS Calculator
Summary
SumatraPDF: Heap out-of-bounds write in vendored CHMLib LZX Huffman table construction reachable from crafted CHM files
Details

SumatraPDF is a multi-format reader for Windows. In 3.6.1 and earlier, a crafted CHM file can supply malformed LZX Huffman code lengths to makedecodetable in ext/CHMLib/lzx.c. In the long-code branch, the function writes new internal nodes through nextsymbol before validating that the canonical Huffman table has overflowed. The PRETREE case can write beyond the 104-entry PRETREEtable into adjacent heap state in struct LZXstate when reached through chmopen, chmretrieveobject, LZXdecompress, and BUILDTABLE. This produces heap memory corruption in the parser process, while arbitrary code execution has not been demonstrated. No fixed version is available as of this review.

Database specific 
{
    "cwe_ids": [
        "CWE-119",
        "CWE-787"
    ],
    "cna_assigner": "GitHub_M",
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/55xxx/CVE-2026-55586.json"
}
References

Affected packages

Git / github.com/sumatrapdfreader/sumatrapdf

Affected ranges

Type
GIT
Repo
https://github.com/sumatrapdfreader/sumatrapdf
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
13b3d4204dd12d93d426f2157b157b149edc29bf
Database specific
Show details 
{
    "source": [
        "AFFECTED_FIELD",
        "REFERENCES"
    ],
    "extracted_events": [
        {
            "introduced": "0"
        },
        {
            "last_affected": "3.6.1rel"
        }
    ]
}

Affected versions

1.*
1.4split
1.5split
1.6split
1.7split
1.8split
1.9split
2.*
2.0split
2.1split
2.2split
2.3split
2.4split
2.5split
3.*
3.0split
3.1.2rel
3.2

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-55586.json"
vanir_signatures 
[
    {
        "signature_type": "Function",
        "digest": {
            "function_hash": "333466651800751386784968678698376194028",
            "length": 1150.0
        },
        "target": {
            "function": "make_decode_table",
            "file": "ext/CHMLib/lzx.c"
        },
        "source": "https://github.com/sumatrapdfreader/sumatrapdf/commit/13b3d4204dd12d93d426f2157b157b149edc29bf",
        "signature_version": "v1",
        "id": "CVE-2026-55586-33d90d36",
        "deprecated": false
    },
    {
        "signature_type": "Line",
        "digest": {
            "threshold": 0.9,
            "line_hashes": [
                "177671882204301113280422802279050044422",
                "26620336724865689684396516187992069053",
                "123276839497677515914653543599139937329",
                "324206445834261895260488051044139967948",
                "274371785417562262774226980150761701388",
                "134812799592600946655891857676065565440",
                "113679281017239692281136640286098250475",
                "78589323859569515700182538992184924089",
                "110541703400306843843919183222958640916",
                "159389642418757943216799085453158377160",
                "22340947793455496966691221165217467435",
                "206606855638962528231561804562460259533",
                "3503848909521385358248225449473124758",
                "51315661027982710574485391190973589568"
            ]
        },
        "target": {
            "file": "src/Flags.cpp"
        },
        "source": "https://github.com/sumatrapdfreader/sumatrapdf/commit/13b3d4204dd12d93d426f2157b157b149edc29bf",
        "signature_version": "v1",
        "id": "CVE-2026-55586-3bf1f236",
        "deprecated": false
    },
    {
        "signature_type": "Function",
        "digest": {
            "function_hash": "178801226923716997501815782287108463511",
            "length": 900.0
        },
        "target": {
            "function": "Flags::~Flags",
            "file": "src/Flags.cpp"
        },
        "source": "https://github.com/sumatrapdfreader/sumatrapdf/commit/13b3d4204dd12d93d426f2157b157b149edc29bf",
        "signature_version": "v1",
        "id": "CVE-2026-55586-440c2380",
        "deprecated": false
    },
    {
        "signature_type": "Line",
        "digest": {
            "threshold": 0.9,
            "line_hashes": [
                "252785926045689090105925934796056552332",
                "237593164361992583336357694505314014304",
                "187983041947982357897651253758938977270",
                "325358613223445933619435847005622860766",
                "50440647055128840725273452426939413478",
                "23288330587947363404755774236095692191",
                "185876171766815245729381404858146648442",
                "54289939130703932091443178319173249302",
                "149379889568359869515649685830312614859"
            ]
        },
        "target": {
            "file": "src/SumatraStartup.cpp"
        },
        "source": "https://github.com/sumatrapdfreader/sumatrapdf/commit/13b3d4204dd12d93d426f2157b157b149edc29bf",
        "signature_version": "v1",
        "id": "CVE-2026-55586-4d9b57bc",
        "deprecated": false
    },
    {
        "signature_type": "Function",
        "digest": {
            "function_hash": "260278129576066028231647026994909904072",
            "length": 9622.0
        },
        "target": {
            "function": "ParseFlags",
            "file": "src/Flags.cpp"
        },
        "source": "https://github.com/sumatrapdfreader/sumatrapdf/commit/13b3d4204dd12d93d426f2157b157b149edc29bf",
        "signature_version": "v1",
        "id": "CVE-2026-55586-5dfdca3c",
        "deprecated": false
    },
    {
        "signature_type": "Line",
        "digest": {
            "threshold": 0.9,
            "line_hashes": [
                "5764663893405368688397072545521378215",
                "111103137399420990503944349032444167507",
                "271702138280848840092882818818405534006"
            ]
        },
        "target": {
            "file": "ext/CHMLib/lzx.h"
        },
        "source": "https://github.com/sumatrapdfreader/sumatrapdf/commit/13b3d4204dd12d93d426f2157b157b149edc29bf",
        "signature_version": "v1",
        "id": "CVE-2026-55586-76802e3d",
        "deprecated": false
    },
    {
        "signature_type": "Function",
        "digest": {
            "function_hash": "907585046289940280678462613265219312",
            "length": 11541.0
        },
        "target": {
            "function": "WinMain",
            "file": "src/SumatraStartup.cpp"
        },
        "source": "https://github.com/sumatrapdfreader/sumatrapdf/commit/13b3d4204dd12d93d426f2157b157b149edc29bf",
        "signature_version": "v1",
        "id": "CVE-2026-55586-8f01f058",
        "deprecated": false
    },
    {
        "signature_type": "Line",
        "digest": {
            "threshold": 0.9,
            "line_hashes": [
                "81554873627085230445750292985880972092",
                "222847510846130793673140604401394174680",
                "186603889605839057154204174214355175907"
            ]
        },
        "target": {
            "file": "src/Flags.h"
        },
        "source": "https://github.com/sumatrapdfreader/sumatrapdf/commit/13b3d4204dd12d93d426f2157b157b149edc29bf",
        "signature_version": "v1",
        "id": "CVE-2026-55586-a711dc4a",
        "deprecated": false
    },
    {
        "signature_type": "Line",
        "digest": {
            "threshold": 0.9,
            "line_hashes": [
                "224328496414094476845108136837497340834",
                "203527598298679645738077421357593646931",
                "307931480959380598160424050035174133318",
                "97561556789632228295512545983578309457",
                "178107192084937046608767651525726521786",
                "59512798476285750558910172243102371303",
                "284269273723614913305328573761363819577",
                "4196990162895935633509295473411831909",
                "168479539341170595307330117983100618835",
                "190086275333835137763318709902024049787",
                "16774836509040331144339608999852370261"
            ]
        },
        "target": {
            "file": "ext/CHMLib/lzx.c"
        },
        "source": "https://github.com/sumatrapdfreader/sumatrapdf/commit/13b3d4204dd12d93d426f2157b157b149edc29bf",
        "signature_version": "v1",
        "id": "CVE-2026-55586-d735e0fa",
        "deprecated": false
    }
]
vanir_signatures_modified 
"2026-08-24T03:59:15Z"