CVE-2026-107729: falha de média gravidade em sumatrapdfreader sumatrapdf
SumatraPDF: Unsigned-to-signed hdrLen validation bypass in SumatraPDF MOBI parsing causes out-of-bounds read
Publicada em
10Vexday Risk Score
Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.
ssvc Trackcvss 5.5
probabilidade de exploração
—
exploração observada
nãonenhuma fonte reporta
SumatraPDF is a multi-format reader for Windows. In 3.7.0.22298, src/MobiDoc.cpp narrows the untrusted unsigned mobiHdr.hdrLen field to a signed integer for validation; values above INT_MAX become negative and bypass the upper-bound check. When the EXTH flag is set, the original unsigned value is reused as a pointer offset, causing DecodeExthHeader() to read beyond the record buffer. Opening a crafted MOBI file can reliably terminate the application with a native access violation; no code execution, information disclosure, or integrity impact has been demonstrated. No fixed version is available as of this review.
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Produtos afetados
sumatrapdfreader · sumatrapdfCVEs relacionadas — sumatrapdfreader sumatrapdf
No mesmo produto, das mais perigosas para as menos.
CVE-2026-25961HIGHSumatraPDF Update MITM -> Arbitrary Code ExecutionEPSS 0.5%CVE-2026-25920MEDIUMSumatraPDF has a heap out-of-bounds read in MOBI HuffDic decompressorEPSS 0.3%CVE-2026-25880HIGHUntrusted Search Path in SumatraPDF Reader (explorer.exe on Windows)EPSS 0.2%CVE-2026-23951MEDIUMSumatraPDF's Integer Underflow in PalmDbReader Leads to CrashEPSS 0.2%CVE-2026-23512HIGHSumatraPDF has an Untrusted Search Path in sumatrapdf/src/AppTools.cppEPSS 0.2%CVE-2026-55586MEDIUMSumatraPDF: Heap out-of-bounds write in vendored CHMLib LZX Huffman table construction reachable from crafted CHM filesEPSS 0.2%