CVE-2026-107729: fallo de gravedad media en sumatrapdfreader sumatrapdf
SumatraPDF: Unsigned-to-signed hdrLen validation bypass in SumatraPDF MOBI parsing causes out-of-bounds read
Publicada el
10Vexday Risk Score
Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.
ssvc Trackcvss 5.5
probabilidad de explotación
—
explotación observada
noninguna fuente lo reporta
SumatraPDF is a multi-format reader for Windows. In 3.7.0.22298, src/MobiDoc.cpp narrows the untrusted unsigned mobiHdr.hdrLen field to a signed integer for validation; values above INT_MAX become negative and bypass the upper-bound check. When the EXTH flag is set, the original unsigned value is reused as a pointer offset, causing DecodeExthHeader() to read beyond the record buffer. Opening a crafted MOBI file can reliably terminate the application with a native access violation; no code execution, information disclosure, or integrity impact has been demonstrated. No fixed version is available as of this review.
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Productos afectados
sumatrapdfreader · sumatrapdfCVEs relacionadas — sumatrapdfreader sumatrapdf
En el mismo producto, de las más peligrosas a las menos.
CVE-2026-25961HIGHSumatraPDF Update MITM -> Arbitrary Code ExecutionEPSS 0.5%CVE-2026-25920MEDIUMSumatraPDF has a heap out-of-bounds read in MOBI HuffDic decompressorEPSS 0.3%CVE-2026-25880HIGHUntrusted Search Path in SumatraPDF Reader (explorer.exe on Windows)EPSS 0.2%CVE-2026-23951MEDIUMSumatraPDF's Integer Underflow in PalmDbReader Leads to CrashEPSS 0.2%CVE-2026-23512HIGHSumatraPDF has an Untrusted Search Path in sumatrapdf/src/AppTools.cppEPSS 0.2%CVE-2026-55586MEDIUMSumatraPDF: Heap out-of-bounds write in vendored CHMLib LZX Huffman table construction reachable from crafted CHM filesEPSS 0.2%