CVE-2026-55586 SumatraPDF: Heap out-of-bounds write in vendored CHMLib LZX Huffman table construction reachable from crafted CHM files
A crafted CHM file triggers a heap out-of-bounds write in SumatraPDF, potentially allowing code execution or crashing the application.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Local or same network only
- Victim action needed
- A user has to click or open something
- Fix
- None listed
What is CVE-2026-55586?
CVE-2026-55586 is a medium-severity memory corruption vulnerability in sumatrapdfreader sumatrapdf, published on 20 Aug 2026. It can only be exploited from the same machine or local network, and only if a user opens a file or follows a link.
Official description
SumatraPDF is a multi-format reader for Windows. In 3.6.1 and earlier, a crafted CHM file can supply malformed LZX Huffman code lengths to make_decode_table in ext/CHMLib/lzx.c. In the long-code branch, the function writes new internal nodes through next_symbol before validating that the canonical Huffman table has overflowed. The PRETREE case can write beyond the 104-entry PRETREE_table into adjacent heap state in struct LZXstate when reached through chm_open, chm_retrieve_object, LZXdecompress, and BUILD_TABLE. This produces heap memory corruption in the parser process, while arbitrary code execution has not been demonstrated. No fixed version is available as of this review.
Which versions are affected by CVE-2026-55586?
How do I fix CVE-2026-55586?
No fix has been published for CVE-2026-55586 yet. Limit exposure of the affected software until one is available.
Upgrade to the fixed version. Memory-safe languages, compiler hardening and fuzzing prevent most new cases. More about Memory corruption.
Is CVE-2026-55586 being exploited?
There is no known exploitation of CVE-2026-55586 in the wild and no public exploit code.
Sources
Also known as GHSA-m423-rp8p-whj8.