SecBoard
Zurück zur CVE-Übersicht

CVE-2026-107729

MEDIUM(5.5)

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

Risk Signal Score14/100 — NIEDRIG
  • CVSS 5.5 — Mittel

EPSS-Score

0.1%

Exploit-Wahrscheinlichkeit (30 Tage)

CVSS Score

5.5

Technische Schwere

Beschreibung

SumatraPDF is a multi-format reader for Windows. In 3.7.0.22298, src/MobiDoc.cpp narrows the untrusted unsigned mobiHdr.hdrLen field to a signed integer for validation; values above INT_MAX become negative and bypass the upper-bound check. When the EXTH flag is set, the original unsigned value is reused as a pointer offset, causing DecodeExthHeader() to read beyond the record buffer. Opening a crafted MOBI file can reliably terminate the application with a native access violation; no code execution, information disclosure, or integrity impact has been demonstrated. No fixed version is available as of this review.

Erkennung & Indikatoren

Ausnutzung

In den geprüften Quellen nicht genannt

Threat-Hunting-Queries

Sentinel/Defender KQL

DeviceProcessEvents
| where FileName == "SumatraPDF.exe"
| where ProcessCommandLine contains ".mobi"
| where ProcessCommandLine contains "poc_mobi_hdrlen_90000000_exth.mobi" // Specific PoC file, adjust for generic detection
| where ExitCode == "-1073741823" // C0000005 ACCESS_VIOLATION
| project TimeGenerated, DeviceName, InitiatingProcessFileName, FileName, ProcessCommandLine, ExitCode

Splunk SPL

index=* sourcetype=WinEventLog:Microsoft-Windows-Sysmon/Operational EventCode=1
| where Image="*\\SumatraPDF.exe"
| where CommandLine="*.mobi*"
| where CommandLine="*poc_mobi_hdrlen_90000000_exth.mobi*" // Specific PoC file, adjust for generic detection
| join type=left EventCode=22
| where ParentImage="*\\SumatraPDF.exe"
| where ExitCode="-1073741823" // C0000005 ACCESS_VIOLATION
| table _time, Host, Image, CommandLine, ExitCode

Sigma

title: SumatraPDF MOBI Out-of-Bounds Read
id: 1ef900cb-ad02-f063-53b0-a0747b098ca5
status: experimental
description: Detects SumatraPDF crashing due to a crafted MOBI file, indicating a potential out-of-bounds read vulnerability.
references:
  - https://github.com/sumatrapdfreader/sumatrapdf/security/advisories/GHSA-86hq-m6hv-67h2
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    Image|endswith: '\\SumatraPDF.exe'
    CommandLine|contains: '.mobi'
    # Specific PoC file, adjust for generic detection
    CommandLine|contains: 'poc_mobi_hdrlen_90000000_exth.mobi'
  condition: selection
falsepositives:
  - Legitimate crashes of SumatraPDF (less likely with specific PoC file name)
level: medium

Elastic ES|QL

from process where process.executable.name : "SumatraPDF.exe" and process.args : "*.mobi" and process.args : "*poc_mobi_hdrlen_90000000_exth.mobi" and process.exit_code == -1073741823
| project @timestamp, host.name, process.executable.name, process.command_line, process.exit_code

SecBoard-generated · behavioral · requires customization — Von SecBoard erzeugt und nicht in einer Zielumgebung validiert. Vor dem Einsatz an die eigene Protokollierung anpassen.

Indikatoren

Datei-Hashes (1)

  • 698BB077561391F922ED14B1D281F7B4E2ACC107577A5EB0FA79B1E61FD4BB92

Übernommen wurden nur Indikatoren, die wörtlich in einer Hersteller- oder Research-Quelle standen.

Referenzen