CVE-2026-107729 Details
Description
SumatraPDF is a multi-format reader for Windows. In 3.7.0.22298, src/MobiDoc.cpp narrows the untrusted unsigned mobiHdr.hdrLen field to a signed integer for validation; values above INT_MAX become negative and bypass the upper-bound check. When the EXTH flag is set, the original unsigned value is reused as a pointer offset, causing DecodeExthHeader() to read beyond the record buffer. Opening a crafted MOBI file can reliably terminate the application with a native access violation; no code execution, information disclosure, or integrity impact has been demonstrated. No fixed version is available as of this review.
A vulnerability in SumatraPDF version 3.7.0.22298 allows for an out-of-bounds read during MOBI file parsing. The issue arises because the application improperly validates the header length of MOBI files. Specifically, the unsigned header length is narrowed to a signed integer, allowing values above the maximum integer limit to be interpreted as negative. This flaw bypasses the upper-bound check and, when the EXTH flag is set, leads to a pointer arithmetic error. The 'DecodeExthHeader()' function then reads beyond the intended buffer, causing a native access violation and application crash. No code execution, information disclosure, or integrity impact has been reported.
As of this review, no fixed version is available.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Oct 8, 2026CISA-ADP
Assessed Oct 9, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/sumatrapdfreader/sumatrapdf/commit/1ef900cbad02f06353b0a0747b098ca596f7c131 | [email protected] | Source CodeVendor |
| https://github.com/sumatrapdfreader/sumatrapdf/security/advisories/GHSA-86hq-m6hv-67h2 | [email protected] | AdvisoryExploitRemedyVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-125 | Out-of-bounds Read | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| SumatraPDF | 3.7.0.22298 |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Oct 9, 2026 | CVE Modified | CISA-ADP |
| Oct 8, 2026 | New CVE Received | [email protected] |