SumatraPDF CVE-2026-107730

Exploitation requires the victim to open an attacker-crafted LIT (Microsoft Reader / .lit eBook) file in SumatraPDF version 3.7.0.22298; the malicious file must contain header fields (hdrLen >= 0x28, nPieces between 5 and 16) specifically tuned so that the signed 32-bit expression hdrLen + nPieces * 16 overflows into a negative section offset reaching LitU32(). Limiting factors are significant: the CVSS vector is AV:L with UI:R, so the attack is not remote and not automatable - it depends entirely on local delivery and the user actively opening the crafted document. No authentication is needed (PR:N) and no non-default configuration is required beyond the application's standard LIT parsing path, but the LIT format is legacy and far less commonly handled than PDF, narrowing the realistic attack surface.

All available signals converge on this being a low-to-moderate priority, denial-of-service-only defect rather than a high-impact threat. The CVSS 3.1 vector (AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H, base 5.5 MEDIUM) explicitly scopes impact to availability only, and the description corroborates this: an integer overflow in LitParseHeader() leads to an invalid read in LitU32() causing 'deterministic application termination' with no demonstrated code execution, information disclosure, arbitrary read, or integrity impact. No EPSS score was provided, the CVE is not on CISA KEV, and no public exploit was identified - so there is no public exploit identified at time of analysis. There are notable conflicts in the supplied metadata: the input Tags list 'RCE' and 'Information Disclosure', but the description directly and explicitly rules out both code execution and information disclosure, so those tags appear mislabeled and should not drive prioritization. The realistic risk is a crash of the reader process when a victim opens a malicious LIT file - annoying and reliable, but not a confidentiality or integrity threat. Note also that although the input states 'No fixed version is available,' a fix commit (10a83278) is already present in the vendor repository, so remediation code exists even if a tagged release does not.

An attacker crafts a malicious LIT (Microsoft Reader eBook) file whose header fields (hdrLen and nPieces) are chosen so that the signed 32-bit computation hdrLen + nPieces * 16 overflows to a negative section offset. The victim is socially engineered into opening the file in SumatraPDF 3.7.0.22298, at which point pointer construction reaches an invalid read in LitU32() and the application deterministically crashes. No public exploit code was identified, though the vendor fix commit illustrates the exact overflow condition.