An unsigned integer field in the MOBI header is cast to a signed type for bounds checking, allowing values larger than INT_MAX to become negative and bypass validation. When the EXTH flag is set the original unsigned value is used as a pointer offset, causing the decoder to read past the end of the buffer. Opening a crafted MOBI file reliably leads to a native access‑violation that crashes the application, but no evidence of code execution or information disclosure exists.

The issue resides in SumatraPDF version 3.7.0.22298. Users running this exact build on Windows are affected. No other versions are listed, and no fixed version is available at the time of review.

The CVSS score is 5.5, indicating a moderate risk of disruption. EPSS data is unavailable, and the vulnerability is not listed in CISA KEV. The attack requires a user to open a malicious MOBI file, so the vector is local and only relevant to end‑users or compromised file distributions. The exploit is straightforward once a suitable file is presented, but it results only in an application crash without code execution.