CVE-2026-107729: CWE-125: Out-of-bounds Read in sumatrapdfreader sumatrapdf
Description
CVE-2026-107729 is an out-of-bounds read vulnerability in SumatraPDF version 3.7.0.22298 and earlier. It occurs due to improper handling of an unsigned integer field that is narrowed to a signed integer, allowing bypass of upper-bound validation. This leads to reading beyond the intended buffer when processing crafted MOBI files with the EXTH flag set. The vulnerability can cause the application to crash with a native access violation. No code execution, information disclosure, or integrity impact has been demonstrated. No fix is currently available.
CVSS v3.1
Score 5.5medium
Affected software
sumatrapdfreader
sumatrapdf
pkg:github/sumatrapdfreader/sumatrapdfRun on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
SumatraPDF 3.7.0.22298 and earlier contain an out-of-bounds read vulnerability in src/MobiDoc.cpp. The issue arises because the unsigned mobiHdr.hdrLen field is narrowed to a signed integer for validation, causing values above INT_MAX to become negative and bypass the upper-bound check. When the EXTH flag is set, the original unsigned value is reused as a pointer offset in DecodeExthHeader(), resulting in reading beyond the record buffer. This can cause the application to terminate with a native access violation upon opening a crafted MOBI file. There is no evidence of code execution, data disclosure, or integrity compromise. No patch or fixed version is available as of the latest review.
Potential Impact
The vulnerability leads to a denial-of-service condition by crashing the SumatraPDF application when opening a specially crafted MOBI file. There is no demonstrated impact on confidentiality, integrity, or code execution. The CVSS score is 5.5 (medium severity), reflecting the availability impact via local attack vector requiring user interaction.
Mitigation Recommendations
No official fix or patch is currently available for this vulnerability. Users should exercise caution when opening untrusted MOBI files in affected versions of SumatraPDF. Monitor the vendor's advisory channels for updates regarding remediation.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- GitHub_M
- Date Reserved
- 2026-10-08T17:21:52.976Z
- Cvss Version
- 3.1
- State
- PUBLISHED
Threat ID: 6ac81a5e2cdf04f6563e4cfa
Added to database: 10/08/2026, 22:34:06 UTC
Last enriched: 10/08/2026, 22:49:03 UTC
Last updated: 10/08/2026, 22:49:04 UTC
Views: 8
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.