The vulnerability arises from the MobiDoc::ParseHeader function failing to validate the header length against the actual remaining buffer before constructing a decoder. An attacker can create a MOBI file that specifies an excessively large header length, causing the decoder to read beyond the allocated heap buffer. This out‑of‑bounds read triggers a crash when a user opens the malicious document, resulting in a denial of service. No direct exploitation of confidentiality or integrity is described; the damage is limited to application availability.

This flaw affects SumatraPDF readers using versions earlier than 3.6. The patch is included in release 3.6; any installation with 3.5 or earlier is vulnerable.

With a CVSS score of 6.8 the vulnerability is considered moderate. The EPSS score is not available, and the vulnerability is not listed in CISA’s KEV catalog, implying limited publicly documented exploitation. The attack vector is local or social engineering – an attacker must supply the crafted file and persuade a user to open it. While RCE is not possible, the crash can be leveraged to disrupt users or services that rely on SumatraPDF for document processing.