{"id":"CVE-2026-107736","published":"2026-10-08T23:16:59.580","lastModified":"2026-10-09T16:17:24.670","description":"SumatraPDF is a multi-format reader for Windows. In 3.6.1 and earlier, MaybeFlipBitmap() asks GDI+ to read the attacker-controlled PropertyTagOrientation size through GetPropertyItem() while supplying only a fixed 64-byte buf on the stack. Opening a crafted TIFF with enough EXIF Orientation values can cause attacker-selected bytes to overwrite stack control data, while tested builds terminate through the stack cookie check. No broader impact is claimed beyond the advisory-supported conditions. No fixed version is available as of this review.","cvssScore":null,"cvssSeverity":null,"cvssVector":null,"cwes":["CWE-121"],"vendors":[],"products":[],"references":[{"url":"https://github.com/sumatrapdfreader/sumatrapdf/commit/6fe2e0239d8ef3466174ac92f3f56e967ce1a4a7","tags":[]},{"url":"https://github.com/sumatrapdfreader/sumatrapdf/security/advisories/GHSA-px68-7vwv-mxpr","tags":[]}],"exploitRefs":[{"url":"https://github.com/sumatrapdfreader/sumatrapdf/commit/6fe2e0239d8ef3466174ac92f3f56e967ce1a4a7","tags":[]},{"url":"https://github.com/sumatrapdfreader/sumatrapdf/security/advisories/GHSA-px68-7vwv-mxpr","tags":[]}],"hasPoc":true,"ai":null}