Four separate range‑validation bugs in SumatraPDF’s LIT parser allow a crafted file to manipulate offsets and sizes that overflow, wrap or become negative before bounds checks are completed. The resulting invalid pointer read can cause deterministic application termination, delivering a denial‑of‑service scenario. The vulnerability does not expose any remote code execution or data disclosure paths beyond the crash, as the advisory indicates no broader impact beyond the affected conditions.

The affected product is SumatraPDF version 3.7.0.22298 and later revisions that include the unpatched range‑validation logic in src/LitDoc.cpp. The vendor listed is sumatrapdfreader:sumatrapdf.

The CVSS score of 5.5 suggests a moderate severity. EPSS is not available, so current exploitation likelihood cannot be quantified. The vulnerability is not listed in CISA KEV. It can be exploited locally by opening a malicious LIT file; an attacker would need access to a system where the user can be tricked into opening the file or the file must be placed in a location the application will read. No fix is available as of the last update, so the mitigation relies on blocking or minimizing exposure.