{"id":"CVE-2026-107729","summary":"SumatraPDF: Unsigned-to-signed hdrLen validation bypass in SumatraPDF MOBI parsing causes out-of-bounds read","details":"SumatraPDF is a multi-format reader for Windows. In 3.7.0.22298, src/MobiDoc.cpp narrows the untrusted unsigned mobiHdr.hdrLen field to a signed integer for validation; values above INT_MAX become negative and bypass the upper-bound check. When the EXTH flag is set, the original unsigned value is reused as a pointer offset, causing DecodeExthHeader() to read beyond the record buffer. Opening a crafted MOBI file can reliably terminate the application with a native access violation; no code execution, information disclosure, or integrity impact has been demonstrated. No fixed version is available as of this review.","aliases":["GHSA-86hq-m6hv-67h2"],"modified":"2026-10-10T07:05:58.951662561Z","published":"2026-10-08T22:18:40.609Z","database_specific":{"cna_assigner":"GitHub_M","cwe_ids":["CWE-125"],"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/107xxx/CVE-2026-107729.json","unresolved_ranges":[{"extracted_events":[{"last_affected":"3.7.0.22298"}],"source":"AFFECTED_FIELD"}]},"references":[{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/107xxx/CVE-2026-107729.json"},{"type":"ADVISORY","url":"https://github.com/sumatrapdfreader/sumatrapdf/security/advisories/GHSA-86hq-m6hv-67h2"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-107729"},{"type":"FIX","url":"https://github.com/sumatrapdfreader/sumatrapdf/commit/1ef900cbad02f06353b0a0747b098ca596f7c131"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/sumatrapdfreader/sumatrapdf","events":[{"introduced":"0"},{"fixed":"1ef900cbad02f06353b0a0747b098ca596f7c131"}],"database_specific":{"source":"REFERENCES"}}],"versions":["3.2","3.1.2rel","3.0split","2.5split","2.4split","2.3split","2.2split","2.1split","2.0split","1.9split","1.8split","1.7split","1.6split","1.5split","1.4split"],"database_specific":{"vanir_signatures_modified":"2026-10-10T07:05:58Z","source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-107729.json","vanir_signatures":[{"deprecated":false,"digest":{"length":3668,"function_hash":"93172328152261526065464032138813401950"},"id":"CVE-2026-107729-3120276e","signature_type":"Function","signature_version":"v1","source":"https://github.com/sumatrapdfreader/sumatrapdf/commit/1ef900cbad02f06353b0a0747b098ca596f7c131","target":{"file":"src/MobiDoc.cpp","function":"MobiDoc::ParseHeader"}},{"signature_version":"v1","source":"https://github.com/sumatrapdfreader/sumatrapdf/commit/1ef900cbad02f06353b0a0747b098ca596f7c131","target":{"file":"src/MobiDoc.cpp"},"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["1541939507829464741408512456049284756","189737415210981728699583238804399781442","55212916160740621400692300896212763609","95428735127564320031064104690942797273"]},"id":"CVE-2026-107729-7f059528","signature_type":"Line"}]}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H"}]}