SecBoard
Zurück zur CVE-Übersicht

CVE-2026-107730

MEDIUM(5.5)

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

Risk Signal Score14/100 — NIEDRIG
  • CVSS 5.5 — Mittel

EPSS-Score

0.1%

Exploit-Wahrscheinlichkeit (30 Tage)

CVSS Score

5.5

Technische Schwere

Beschreibung

SumatraPDF is a multi-format reader for Windows. In 3.7.0.22298, LitParseHeader() in src/LitDoc.cpp computes the attacker-controlled hdrLen + nPieces * 16 section offset using signed 32-bit arithmetic without validating the complete result. When the component values make that aggregate calculation overflow to a negative value, pointer construction reaches an invalid read in LitU32(), causing deterministic application termination. The supplied evidence does not demonstrate code execution, information disclosure, arbitrary read, or integrity impact. No fixed version is available as of this review.

Erkennung & Indikatoren

Ausnutzung

In den geprüften Quellen nicht genannt

Threat-Hunting-Queries

Detects attempts to open malformed LIT files that could trigger the integer overflow, leading to application termination. Focuses on file access events for SumatraPDF.

Sentinel/Defender KQL

DeviceFileEvents
| where InitiatingProcessFileName == "SumatraPDF.exe"
| where FileName endswith ".lit"
| where ActionType == "FileCreated" or ActionType == "FileModified"
| project Timestamp, DeviceName, InitiatingProcessFileName, FileName, FolderPath, SHA256

Splunk SPL

index=* sourcetype=WinEventLog:Microsoft-Windows-Sysmon/Operational EventCode=11 Image="*\\SumatraPDF.exe" TargetFilename="*.lit" | table _time, Host, Image, TargetFilename, Hashes

Sigma

title: SumatraPDF LIT Header Integer Overflow
logsource:
  category: process_access
  product: windows
detection:
  selection:
    Image|endswith: '\SumatraPDF.exe'
    TargetFilename|endswith: '.lit'
  condition: selection
fields:
  - Image
  - TargetFilename
level: medium

Elastic ES|QL

from file where process.executable.endswith("\\SumatraPDF.exe") and file.extension == "lit" and event.type == "creation" or event.type == "change" | select @timestamp, host.name, process.executable, file.path, file.hash.sha256

SecBoard-generated · behavioral · requires customization — Von SecBoard erzeugt und nicht in einer Zielumgebung validiert. Vor dem Einsatz an die eigene Protokollierung anpassen.

Indikatoren

Datei-Hashes (2)

  • E52CF502610F661F0605B86E5A5E61C75824410C8D773C2E8EBF9670061F124E
  • CE32993A1964B6861B225811C6E0DD713C469A82B884314876D0A6C2E4DB8903

Übernommen wurden nur Indikatoren, die wörtlich in einer Hersteller- oder Research-Quelle standen.

Referenzen