SumatraPDF
CVE-2026-107729
MEDIUM
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessCraft MOBI with oversized hdrLen + EXTH flag
-
DeliveryDeliver file via email or download
-
ExploitVictim opens file in SumatraPDF
-
ExecutionDecodeExthHeader reads past record buffer
-
ImpactAccess violation crashes application
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Bounds checking, read limits
MITRE ATT&CK
1 technique across 1 tactic: Collection The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires the target to open an attacker-crafted MOBI file in SumatraPDF where mobiHdr.hdrLen is set to a value above INT_MAX (>= 0x80000000) with the EXTH flag set, triggering the out-of-bounds read in DecodeExthHeader(). This affects default MOBI parsing in version 3.7.0.22298, so no non-default configuration is needed. The principal limiting factor is mandatory user interaction (UI:R): the victim must actively open the malicious file locally - there is no remote or automatic trigger - and the impact is confined to an application crash, with no demonstrated path to code execution or data access. |
| Impact | This is a genuinely moderate, DoS-only issue rather than a high-impact priority, and the raw signals mostly agree once the noisy tags are discarded. The provided CVSS:3.1 vector (AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H = 5.5 Medium) correctly models a local, user-interaction-dependent crash with availability-only impact - the description explicitly states 'no code execution, information disclosure, or integrity impact has been demonstrated,' so C:N/I:N are well justified. The input Tags ('RCE', 'Information Disclosure', 'Buffer Overflow') directly CONTRADICT both the description and the CWE-125 (out-of-bounds READ) classification: an OOB read that reliably produces a native access violation is a reliability/availability defect, not a demonstrated RCE or disclosure path. No EPSS score, no CISA KEV listing, and no POC were provided; absence of these is consistent with a newly reported, unpatched crash bug. SSVC framing: exploitation = none observed, automatable = no (requires a victim to open a crafted file), technical impact = partial (crash only). Net: treat as a bug-fix-priority defect, not an emergency - the main caveat is that no fixed version yet exists, so exposure persists until the vendor ships a release containing commit 1ef900cb. |
| Exploit ScenarioDerived | An attacker crafts a MOBI e-book whose mobiHdr.hdrLen field is set above 0x80000000 with the EXTH flag enabled, then distributes it via email, a download link, or a file share. When a victim opens the file in SumatraPDF, DecodeExthHeader() reuses the oversized unsigned value as a pointer offset and reads far past the record buffer, reliably terminating the application with an access violation. No public exploit code was identified at time of analysis, and the impact is limited to a crash (denial of service). |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 08, 2026
Opening a crafted MOBI file in SumatraPDF 3.7.0.22298 triggers an out-of-bounds read that reliably terminates the application with a native access violation. The bug is a signed/unsigned narrowing flaw in src/MobiDoc.cpp: an attacker-supplied mobiHdr.hdrLen value above INT_MAX becomes negative during the upper-bound check, and when the EXTH flag is set that same original unsigned value is reused as a pointer offset, driving DecodeExthHeader() past the end of the record buffer. Only denial of service has been demonstrated - no code execution, information disclosure, or integrity impact - and the CVSS vector (AV:L/PR:N/UI:R, C:N/I:N/A:H) reflects that the victim must actively open the malicious file locally; no public exploit has been identified at time of analysis and this CVE is not in CISA KEV. Several third-party tags (RCE, Information Disclosure, Microsoft) are inconsistent with the technical evidence and the assessed vector and should be discounted.
RemediationAI
No vendor-released patched version is confirmed at time of analysis - the advisory notes no fixed build as of this review - but an upstream fix is available as a commit/PR (1ef900cbad02f06353b0a0747b098ca596f7c131) that changes the hdrLen bounds check in src/MobiDoc.cpp to an unsigned comparison; users should either build from source at or after that commit or upgrade to the first SumatraPDF release that contains it, and should monitor GHSA-86hq-m6hv-67h2 for the tagged fixed version. Because the issue is DoS-only and requires the user to open a malicious MOBI file, the practical mitigation is to avoid opening untrusted .mobi files with this build, or to open them only inside a sandbox or under a low-privileged account so the crash is contained - accepting reduced convenience as the trade-off. Blocking the MOBI format outright (for example by handling untrusted documents in a separate low-integrity context) eliminates exposure but costs the reader's MOBI support, and applying Mark-of-the-Web/attachment restrictions reduces the chance of accidental opening at the cost of extra user friction. There is no evidence supporting a code-execution path, so generic memory-hardening measures should be treated as defense in depth rather than a substitute for upgrading once a patched build is published.
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The vulnerability lives in SumatraPDF's MOBI/PalmDOC parser (src/MobiDoc.cpp), specifically in MobiDoc::ParseHeader() and the downstream DecodeExthHeader() routine. The MOBI container begins with a PalmDOC header of fixed length (kPalmDocHeaderLen), followed by a MOBI header whose hdrLen field is defined as an unsigned 32-bit quantity. The vulnerable code computed the check as 'kPalmDocHeaderLen + (int)mobiHdr.hdrLen > recSize', casting the unsigned field to a signed int; any hdrLen at or above 0x80000000 wraps to a negative number, so the sum no longer exceeds recSize and the bounds check is bypassed. When the EXTH flag is set, the un-truncated unsigned value is then used as an offset for locating the EXTH header, causing DecodeExthHeader() to read memory beyond the record buffer. This is a classic CWE-125 out-of-bounds read rooted in integer truncation/signedness confusion rather than an attacker-controlled write, which is why the demonstrated outcome is an application crash (A:H) with no confidentiality or integrity impact. The upstream fix (commit 1ef900cbad02f06353b0a0747b098ca596f7c131) rewrites the comparison to operate on unsigned types: 'if (mobiHdr.hdrLen > (u32)(recSize - kPalmDocHeaderLen))'. The provided CPE (cpe:2.3:a:sumatrapdfreader:sumatrapdf:*:*:*:*:*:*:*:*) uses a wildcard version, so it flags the product broadly rather than pinning a single build; the confirmed vulnerable build in the advisory is 3.7.0.22298.
Know when Sumatrapdf gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Exploitation needs a locally opened crafted file so AV:L/UI:R with no privileges (PR:N); crash-only impact gives C:N/I:N and A:H.
Primary rating from Vendor (GitHub_M).
CVSS VectorVendor: GitHub_M
DescriptionCVE.org
SumatraPDF is a multi-format reader for Windows. In 3.7.0.22298, src/MobiDoc.cpp narrows the untrusted unsigned mobiHdr.hdrLen field to a signed integer for validation; values above INT_MAX become negative and bypass the upper-bound check. When the EXTH flag is set, the original unsigned value is reused as a pointer offset, causing DecodeExthHeader() to read beyond the record buffer. Opening a crafted MOBI file can reliably terminate the application with a native access violation; no code execution, information disclosure, or integrity impact has been demonstrated. No fixed version is available as of this review.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
GitHub
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.
Affected Products (CPE)CVE.org
More in Sumatrapdf
View allSumatraPDF 3.5.2 and earlier on Windows contains an untrusted search path vulnerability in the Advanced Options feature
SumatraPDF 3.5.2 and earlier on Windows allows arbitrary code execution when a user opens a PDF and selects "Show in fol
SumatraPDF versions 3.5.0 through 3.5.2 fail to validate TLS certificates during software updates and execute installers
Heap-based buffer overflow in SumatraPDF before 2.1 allows remote attackers to execute arbitrary code via a crafted PDF
Heap-based buffer overflow in SumatraPDF before 2.1 allows remote attackers to execute arbitrary code via a crafted PDF
SumatraPDF versions 3.5.2 and earlier are vulnerable to a heap buffer over-read in the MOBI file parser due to incomplet
SumatraPDF on Windows is vulnerable to a denial-of-service attack through a maliciously crafted Mobi file that triggers
A buffer overflow in SumatraPDF Reader v3.4.6 allows attackers to cause a Denial of Service (DoS) via a crafted text fil
Local code execution in SumatraPDF 3.6.1 and earlier on Windows is possible when a user opens an attacker-supplied docum
Parsing a malformed PDF in SumatraPDF 3.6.1 can crash the reader through a signed integer overflow in the PageLabels han
Command-line argument injection in SumatraPDF 3.5.2 and earlier lets an attacker-controlled SyncTeX source filename esca
Argument injection in the AI translation feature of SumatraPDF 3.6.1 and earlier allows text placed in a document select
Exploit-DB