CVE-2026-107729: SumatraPDF: Unsigned-to-signed hdrLen validation bypass in SumatraPDF MOBI parsing causes out-of-bounds read
SumatraPDF is a multi-format reader for Windows. In 3.7.0.22298, src/MobiDoc.cpp narrows the untrusted unsigned mobiHdr.hdrLen field to a signed integer for validation; values above INTMAX become negative and bypass the upper-bound check. When the EXTH flag is set, the original unsigned value is reused as a pointer offset, causing DecodeExthHeader() to read beyond the record buffer. Opening a crafted MOBI file can reliably terminate the application with a native access violation; no code execution, information disclosure, or integrity impact has been demonstrated. No fixed version is available as of this review.
Affected Software
Event History
Frequently Asked Questions
What conditions are required to trigger the crash?
A user must open a crafted MOBI file. The file must use an oversized hdrLen value above INT_MAX and set the EXTH flag so that the unchecked unsigned length is used as an offset during EXTH header decoding.
What is the practical impact?
The demonstrated impact is a reliable native access violation that terminates SumatraPDF. Code execution, information disclosure, and integrity impact have not been demonstrated.
Are users protected by updating SumatraPDF?
No fixed version is available as of the review. The affected code is identified in SumatraPDF 3.7.0.22298.
What can be done while no fixed version is available?
Avoid opening untrusted MOBI files, particularly files received from unverified sources. This limits the user-interaction path required to trigger the out-of-bounds read.