{"id":"CVE-2026-107729","revision":"044eeec625ca46938b34e85e85bddb42","records":[{"revision":"044eeec625ca46938b34e85e85bddb42","observedAt":"2026-10-23T15:48:27.903+00:00","statement":{"source":"cve-program","id":"CVE-2026-107729","aliases":[],"title":"SumatraPDF: Unsigned-to-signed hdrLen validation bypass in SumatraPDF MOBI parsing causes out-of-bounds read","description":"SumatraPDF is a multi-format reader for Windows. In 3.7.0.22298, src/MobiDoc.cpp narrows the untrusted unsigned mobiHdr.hdrLen field to a signed integer for validation; values above INT_MAX become negative and bypass the upper-bound check. When the EXTH flag is set, the original unsigned value is reused as a pointer offset, causing DecodeExthHeader() to read beyond the record buffer. Opening a crafted MOBI file can reliably terminate the application with a native access violation; no code execution, information disclosure, or integrity impact has been demonstrated. No fixed version is available as of this review.","state":0,"publishedAt":"2026-10-08T22:18:40.609+00:00","modifiedAt":"2026-10-09T15:46:45.488+00:00","affected":[{"ecosystem":"Vendor product","name":"sumatrapdf","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"vendor\": \"sumatrapdfreader\",\n                    \"product\": \"sumatrapdf\",\n                    \"versions\": [\n                        {\n                            \"version\": \"<= 3.7.0.22298\",\n                            \"status\": \"affected\"\n                        }\n                    ]\n                }"}],"metrics":[{"system":"CVSS 3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","score":5.5,"severity":"MEDIUM"}],"references":["https://github.com/sumatrapdfreader/sumatrapdf/security/advisories/GHSA-86hq-m6hv-67h2","https://github.com/sumatrapdfreader/sumatrapdf/commit/1ef900cbad02f06353b0a0747b098ca596f7c131"],"sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-107729","license":"CVE Program Terms of Use","key":"cve-program:CVE-2026-107729","identifiers":["CVE-2026-107729"]},"retained":false,"historicalAffected":[]}],"coverage":[]}