SumatraPDF contains an off‑by‑one error in the completion of the PalmDbReader::GetRecord routine when parsing a Mobi file with exactly two records. The bug causes an integer underflow during a size calculation, leading to an out‑of‑bounds heap read that triggers a crash of the application. The crash is non‑reversible and results in denial of service for the affected user. This weakness falls under CWE‑125 (Out‑of‑Bounds Read), CWE‑191 (Signed Integer Overflow), and CWE‑193 (Type Conversion Error).

SumatraPDF (sumatrapdfreader:sumatrapdf) on Windows, all released versions affected. The warning applies to any installation of SumatraPDF that respects the current default file handling for Mobi (Palm database) files.

The CVSS score of 5.5 classifies the vulnerability as medium severity. The EPSS score of less than 1% indicates a very low likelihood of exploitation in the wild. The vulnerability is not listed in the CISA KEV catalog. The attack vector is likely local or low‑enumeration: the attacker must supply a crafted Mobi file that the victim opens or that is processed by the application automatically. No known published exploitation code exists beyond the laboratory trigger.