Posted by Ron E on Sep 15An integer overflow vulnerability exists in the LZX decompression routines of CHMLib (tested in version 0.40, latest release as of 2025). The issue occurs within lzx.c during bitstream parsing (lzx_read_lens and LZXdecompress), where crafted CHM files can supply values that cause left-shift operations to exceed the representable range of 32-bit signed integers. When processing malformed compressed blocks, operations such as: leaf = pos >>...