{"apiVersion":"1.0","identifier":"CVE-2026-55586","description":"SumatraPDF is a multi-format reader for Windows. In 3.6.1 and earlier, a crafted CHM file can supply malformed LZX Huffman code lengths to make_decode_table in ext/CHMLib/lzx.c. In the long-code branch, the function writes new internal nodes through next_symbol before validating that the canonical Huffman table has overflowed. The PRETREE case can write beyond the 104-entry PRETREE_table into adjacent heap state in struct LZXstate when reached through chm_open, chm_retrieve_object, LZXdecompress, and BUILD_TABLE. This produces heap memory corruption in the parser process, while arbitrary code execution has not been demonstrated. No fixed version is available as of this review.","publishedAt":"2026-08-20T17:18:27","lastModifiedAt":"2026-08-21T22:16:41","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-55586","cvssScore":6.6,"cvssVector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:H/A:L","epssProbability":0.00127,"riskScore":0.67,"affectedProduct":"SumatraPDF","affectedVersions":"<=3.6.1","vulnerabilityType":"Critical software","operatingSystems":[],"links":{"self":"https://www.redsauce.net/api/cves/CVE-2026-55586","webPages":{"es":"https://www.redsauce.net/es/cves/CVE-2026-55586","en":"https://www.redsauce.net/en/cves/CVE-2026-55586","fr":"https://www.redsauce.net/fr/cves/CVE-2026-55586","pt":"https://www.redsauce.net/pt/cves/CVE-2026-55586","de":"https://www.redsauce.net/de/cves/CVE-2026-55586","sk":"https://www.redsauce.net/sk/cves/CVE-2026-55586","el":"https://www.redsauce.net/el/cves/CVE-2026-55586"},"source":"https://nvd.nist.gov/vuln/detail/CVE-2026-55586"}}