Microsoft Reader versions 2.1.1.3143 and below suffer from an integer overflow vulnerability during the handling of the number of pieces of the initial ITLS header at offset 0x10. Proof of concept code included.
692bf8bac783fa54db238ce06c110d02dc71aff8ff622da11ed1a7e4c7c863fa