CVE-2026-107729 in SumatraPDF
Summary
by MITRE • 10/09/2026
SumatraPDF is a multi-format reader for Windows. In 3.7.0.22298, src/MobiDoc.cpp narrows the untrusted unsigned mobiHdr.hdrLen field to a signed integer for validation; values above INT_MAX become negative and bypass the upper-bound check. When the EXTH flag is set, the original unsigned value is reused as a pointer offset, causing DecodeExthHeader() to read beyond the record buffer. Opening a crafted MOBI file can reliably terminate the application with a native access violation; no code execution, information disclosure, or integrity impact has been demonstrated. No fixed version is available as of this review.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 10/09/2026
SumatraPDF serves as a widely utilized multi-format document reader for Windows operating systems, supporting various e-book and PDF formats including MOBI files which are commonly associated with Amazon Kindle content. The vulnerability identified in version 3.7.0.22298 resides within the source file MobiDoc.cpp and involves a critical type conversion error during the parsing of MOBI headers. Specifically, the application processes an untrusted unsigned integer field labeled hdrLen from the mobiHdr structure. This value is narrowed or cast to a signed integer for validation purposes against upper-bound limits designed to prevent buffer overflows. Because the original field is unsigned but the comparison variable is signed, any input value exceeding INT_MAX results in sign extension issues where the large positive unsigned integer wraps around to become a negative number when interpreted as a signed type.
This arithmetic anomaly allows crafted MOBI files with excessively large header length values to bypass security checks intended to limit memory allocation and access ranges. When the EXTH flag is set within the file structure, the application proceeds to use the original unsigned value rather than the validated signed version for calculating pointer offsets. Consequently, the DecodeExthHeader function attempts to read data from a memory location calculated by adding this oversized offset to a base buffer address. Since the offset exceeds the allocated size of the record buffer, the operation results in an out-of-bounds read access violation. This flaw is classified under CWE-190 Integer Overflow or Wraparound and aligns with ATT&CK technique T1203 Exploitation for Client Execution if leveraged within a social engineering context involving malicious document delivery.
The operational impact of this vulnerability is primarily limited to denial of service conditions rather than remote code execution or data exfiltration in the current assessment. Opening a specially crafted MOBI file triggers a native access violation that reliably terminates the SumatraPDF application process immediately upon parsing the malformed header. While such crashes can disrupt user workflows and potentially cause loss of unsaved work, there is no demonstrated evidence at this time indicating that the vulnerability leads to arbitrary code execution, sensitive information disclosure through memory leakage, or integrity compromise of the host system. The crash occurs during the initial validation phase before any significant payload processing takes place, which restricts the attack surface for more severe exploits like stack-based buffer overflows or heap corruption attacks that typically follow successful out-of-bounds reads in other contexts.
Mitigation strategies must focus on defensive programming practices and user awareness since no fixed version is available as of this review. Developers should enforce strict type safety by ensuring that comparisons involving potentially large unsigned values do not involve signed integers without explicit casting checks or range validation prior to conversion. Implementing bounds checking that validates the original unsigned value against maximum allowable limits before any narrowing conversions occurs would prevent the bypass described in this analysis. For end-users, it is advisable to exercise caution when opening MOBI files from untrusted sources and consider using alternative readers with more rigorous input sanitization mechanisms until a patched version of SumatraPDF is released. Additionally enabling operating system-level protections such as Data Execution Prevention and Address Space Layout Randomization can provide additional layers of defense against potential future exploitation vectors derived from similar integer handling flaws in document parsers.