CVE-2026-107729

SumatraPDF is a multi-format reader for Windows. In 3.7.0.22298, src/MobiDoc.cpp narrows the untrusted unsigned mobiHdr.hdrLen field to a signed integer for validation; values above INTMAX become negative and bypass the upper-bound check. When the EXTH flag is set, the original unsigned value is...

CVE-2026-107729 SumatraPDF: Unsigned-to-signed hdrLen validation bypass in SumatraPDF MOBI parsing causes out-of-bounds read

SumatraPDF is a multi-format reader for Windows. In 3.7.0.22298, src/MobiDoc.cpp narrows the untrusted unsigned mobiHdr.hdrLen field to a signed integer for validation; values above INTMAX become negative and bypass the upper-bound check. When the EXTH flag is set, the original unsigned value is...

CVE-2026-107729

The multi-format reader SumatraPDF (version 3.7.0.22298) is vulnerable to an out-of-bounds read in src/MobiDoc.cpp during MOBI parsing. The root cause is an unsigned-to-signed conversion where the mobiHdr.hdrLen field is narrowed to a signed integer for validation. Values exceeding INT_MAX become...

CVE-2026-107729 SumatraPDF: Unsigned-to-signed hdrLen validation bypass in SumatraPDF MOBI parsing causes out-of-bounds read

SumatraPDF is a multi-format reader for Windows. In 3.7.0.22298, src/MobiDoc.cpp narrows the untrusted unsigned mobiHdr.hdrLen field to a signed integer for validation; values above INTMAX become negative and bypass the upper-bound check. When the EXTH flag is set, the original unsigned value is...

EUVD-2026-95400

SumatraPDF is a multi-format reader for Windows. In 3.7.0.22298, src/MobiDoc.cpp narrows the untrusted unsigned mobiHdr.hdrLen field to a signed integer for validation; values above INTMAX become negative and bypass the upper-bound check. When the EXTH flag is set, the original unsigned value is...

CVE-2026-107729 SumatraPDF: Unsigned-to-signed hdrLen validation bypass in SumatraPDF MOBI parsing causes out-of-bounds read

SumatraPDF is a multi-format reader for Windows. In 3.7.0.22298, src/MobiDoc.cpp narrows the untrusted unsigned mobiHdr.hdrLen field to a signed integer for validation; values above INTMAX become negative and bypass the upper-bound check. When the EXTH flag is set, the original unsigned value is...

CVE-2026-107729

SumatraPDF is a multi-format reader for Windows. In 3.7.0.22298, src/MobiDoc.cpp narrows the untrusted unsigned mobiHdr.hdrLen field to a signed integer for validation; values above INTMAX become negative and bypass the upper-bound check. When the EXTH flag is set, the original unsigned value is...

EUVD-2026-86296

SumatraPDF is a multi-format reader for Windows. Prior to 3.6, the MobiDoc::ParseHeader function in src/MobiDoc.cpp validates a record using kMobiHeaderMinLen but DecodeMobiDocHeader constructs a decoder sized for kMobiHeaderLen without receiving the actual remaining buffer length. A malformed MO...

CVE-2026-26054

SumatraPDF, a multi-format reader for Windows, is vulnerable to a heap out-of-bounds read in the MobiDoc::ParseHeader function within src/MobiDoc.cpp. The issue occurs because DecodeMobiDocHeader constructs a decoder sized for kMobiHeaderLen without verifying the actual remaining buffer length, e...

CVE-2026-26054 SumatraPDF: Heap out-of-bounds read in MOBI header parser.

SumatraPDF is a multi-format reader for Windows. Prior to 3.6, the MobiDoc::ParseHeader function in src/MobiDoc.cpp validates a record using kMobiHeaderMinLen but DecodeMobiDocHeader constructs a decoder sized for kMobiHeaderLen without receiving the actual remaining buffer length. A malformed MO...

CVE-2026-26054

SumatraPDF is a multi-format reader for Windows. Prior to 3.6, the MobiDoc::ParseHeader function in src/MobiDoc.cpp validates a record using kMobiHeaderMinLen but DecodeMobiDocHeader constructs a decoder sized for kMobiHeaderLen without receiving the actual remaining buffer length. A malformed MO...

CVE-2026-26054 SumatraPDF: Heap out-of-bounds read in MOBI header parser.

SumatraPDF is a multi-format reader for Windows. Prior to 3.6, the MobiDoc::ParseHeader function in src/MobiDoc.cpp validates a record using kMobiHeaderMinLen but DecodeMobiDocHeader constructs a decoder sized for kMobiHeaderLen without receiving the actual remaining buffer length. A malformed MO...

CVE-2026-26054: Out-of-bounds Read

SumatraPDF is a multi-format reader for Windows. Prior to 3.6, the MobiDoc::ParseHeader function in src/MobiDoc.cpp validates a record using kMobiHeaderMinLen but DecodeMobiDocHeader constructs a decoder sized for kMobiHeaderLen without receiving the actual remaining buffer length. A malformed MO...

moear-package-mobi (>=1.0.0a1, <=1.1.2.post0), moear-spider-zhihudaily (>=1.0.0a1, <=1.1.1) potentially affected by CVE-2026-84366 via scrapy (1.5.2)

scrapy PYPI version 1.5.2 is affected by a known vulnerability. The following packages have a transitive dependency on scrapy and may be impacted: - moear-package-mobi =1.0.0a1, =1.0.0a1, =1.1.1 Source cves: CVE-2026-84366 Source advisory: OSV:PYSEC-2026-3918...

moear-package-mobi (>=1.0.0a1, <=1.1.2.post0), moear-spider-zhihudaily (>=1.0.0a1, <=1.1.1) potentially affected by CVE-2026-84366 via scrapy (1.5.2)

scrapy PYPI version 1.5.2 is affected by a known vulnerability. The following packages have a transitive dependency on scrapy and may be impacted: - moear-package-mobi =1.0.0a1, =1.0.0a1, =1.1.1 Source cves: CVE-2026-84366 Source advisory: OSV:GHSA-76G3-C3X4-CRVX...

Malicious code in abiuna-mobi-amuasui (npm)

Source: amazon-inspector 1f1959fdda209d10c7ae30aed9933249ad3aa6aa8dff4c6a2d7b8a23e2cb01c5 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js, autopublish.js, autopublish2.js, autopublish3.js designed ...

Malicious code in abiuna-mobi-amuasubi (npm)

Source: amazon-inspector 8b12a45cddb612d944b13842edd60af6a438a8c83fa3902a0cbd169d09466969 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js, autopublish.js, autopublish2.js, autopublish3.js designed ...

Malicious code in abiuna-mobi-aymsi (npm)

Source: amazon-inspector 310496ffd99f159f1dec6aa95598092bea45c3b33a077b6e030bf3e1555658a9 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js, autopublish.js, autopublish2.js, autopublish3.js designed ...

Malicious code in abiuna-mobi-amuasubioa (npm)

Source: amazon-inspector aadda7a480afe705209ef27d3128f48c2aa6915651571a843c087a95afdbcab0 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js, autopublish.js, autopublish2.js, autopublish3.js designed ...

Malicious code in abiuna-mobi-amuasubia (npm)

Source: amazon-inspector e42a1a6de03a106bbf8fe8aada29f0d787829c00f6f734f6a59af6ed5ead6859 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js, autopublish.js, autopublish2.js, autopublish3.js designed ...