CVE-2026-26054
MediumCVSS 6.8Summary
SumatraPDF before version 3.6 has a vulnerability in the MobiDoc::ParseHeader function, where the decoder is sized for a fixed length rather than the actual buffer length. A malformed MOBI file can cause a read beyond a short heap buffer, leading to application crash.
Risk Assessment
Opening a specially crafted MOBI file can cause the program to crash, potentially being used as a Denial of Service attack.
Recommendation
Update SumatraPDF to version 3.6 or later to avoid the out-of-bounds read error.
Other vulnerabilities in SumatraPDF
See all- CVE-2026-88361Unknown
SumatraPDF 3.6.1 contains an integer overflow vulnerability in EngineMupdf::BuildPageLabelRec() when parsing PDF PageLabels /Nums entries.
- CVE-2026-55586Medium
SumatraPDF is a multi-format reader for Windows. In 3.6.1 and earlier, a crafted CHM file can supply malformed LZX Huffman code lengths to make_decode_table in ext/CHMLib/lzx.c. In the long-code branch, the function writes new internal nodes through next_symbol before validating that the canonical Huffman table has overflowed. The PRETREE case can write beyond the 104-entry PRETREE_table into adjacent heap state in struct LZXstate when reached through chm_open, chm_retrieve_object, LZXdecompress, and BUILD_TABLE. This produces heap memory corruption in the parser process, while arbitrary code execution has not been demonstrated. No fixed version is available as of this review.
Original NVD description (English source)
SumatraPDF is a multi-format reader for Windows. Prior to 3.6, the MobiDoc::ParseHeader function in src/MobiDoc.cpp validates a record using kMobiHeaderMinLen but DecodeMobiDocHeader constructs a decoder sized for kMobiHeaderLen without receiving the actual remaining buffer length. A malformed MOBI file can use an attacker-controlled header length to bypass optional-field early returns and cause the decoder to read beyond a short heap buffer. Opening the crafted document can crash SumatraPDF. This issue is fixed in version 3.6.