CVE-2026-107729

SumatraPDF is a multi-format reader for Windows. In 3.7.0.22298, src/MobiDoc.cpp narrows the untrusted unsigned mobiHdr.hdrLen field to a signed integer for validation; values above INTMAX become negative and bypass the upper-bound check. When the EXTH flag is set, the original unsigned value is...

CVE-2026-107729

The multi-format reader SumatraPDF (version 3.7.0.22298) is vulnerable to an out-of-bounds read in src/MobiDoc.cpp during MOBI parsing. The root cause is an unsigned-to-signed conversion where the mobiHdr.hdrLen field is narrowed to a signed integer for validation. Values exceeding INT_MAX become...

CVE-2026-107729 SumatraPDF: Unsigned-to-signed hdrLen validation bypass in SumatraPDF MOBI parsing causes out-of-bounds read

SumatraPDF is a multi-format reader for Windows. In 3.7.0.22298, src/MobiDoc.cpp narrows the untrusted unsigned mobiHdr.hdrLen field to a signed integer for validation; values above INTMAX become negative and bypass the upper-bound check. When the EXTH flag is set, the original unsigned value is...

CVE-2026-107729 SumatraPDF: Unsigned-to-signed hdrLen validation bypass in SumatraPDF MOBI parsing causes out-of-bounds read

SumatraPDF is a multi-format reader for Windows. In 3.7.0.22298, src/MobiDoc.cpp narrows the untrusted unsigned mobiHdr.hdrLen field to a signed integer for validation; values above INTMAX become negative and bypass the upper-bound check. When the EXTH flag is set, the original unsigned value is...

CVE-2026-26054 SumatraPDF: Heap out-of-bounds read in MOBI header parser.

SumatraPDF is a multi-format reader for Windows. Prior to 3.6, the MobiDoc::ParseHeader function in src/MobiDoc.cpp validates a record using kMobiHeaderMinLen but DecodeMobiDocHeader constructs a decoder sized for kMobiHeaderLen without receiving the actual remaining buffer length. A malformed MO...