Description

SumatraPDF 3.6.1 contains an integer overflow vulnerability in EngineMupdf::BuildPageLabelRec() when parsing PDF PageLabels /Nums entries.

Is your site exposed to CVE-2026-88361?

Run a free security scan — no signup, results in seconds.

Scan my site

References

Other References

https://github.com/chenjiefeng2001/sumatrapdf_folked/commit/b22a8c71ddc9de80ece5f88d14b434c20fee912e https://github.com/haimag/sumatrapdf/commit/8b999ff1bf0a8df244e75440682a3fd9a038eb2d https://github.com/sumatrapdfreader/sumatrapdf/issues/5952

Frequently Asked Questions

What is CVE-2026-88361? +

SumatraPDF 3.6.1 contains an integer overflow vulnerability in EngineMupdf::BuildPageLabelRec() when parsing PDF PageLabels /Nums entries.

How do I check if I'm vulnerable to CVE-2026-88361? +

You can use Secably's free Website Scanner to check your website for known vulnerabilities. For infrastructure scanning, use the Port Scanner to identify exposed services that may be affected. Check the vendor advisories linked above for specific patch and version information.