CVE-2026-26054GHSA-27p6-wrfp-pgm8
SumatraPDF: Heap out-of-bounds read in MOBI header parser.
sumatrapdfreader sumatrapdf
CVSS
6.8MediumExploitationPublic exploit codeCISA's assessment says proof of concept code is public, assessed 28 Sep 2026. Not in the KEV catalogCISA via CVE List
Exploit odds (EPSS)0.14%Chance of exploitation activity in the next 30 days, higher than 2% of CVEs. Scored 23 Oct 2026FIRST EPSS
Fixed inNone listedNo source names a fixed version. Check the vendor advisory below
What fixes it
No source in this snapshot names a fixed version. The vendor advisories under References are the place to check.
Description
SumatraPDF is a multi-format reader for Windows. Prior to 3.6, the MobiDoc::ParseHeader function in src/MobiDoc.cpp validates a record using kMobiHeaderMinLen but DecodeMobiDocHeader constructs a decoder sized for kMobiHeaderLen without receiving the actual remaining buffer length. A malformed MOBI file can use an attacker-controlled header length to bypass optional-field early returns and cause the decoder to read beyond a short heap buffer. Opening the crafted document can crash SumatraPDF. This issue is fixed in version 3.6.
Text from CVE List
Affected versions 1
- sumatrapdfaffected: < 3.6CVE List
References 4
- github.com/sumatrapdfreader/sumatrapdf/commit/24b9ce83383bbaa48b3efe00e4d30cccea126198Fixvia CVE List
- github.com/sumatrapdfreader/sumatrapdf/releases/tag/3.6relFixvia CVE List
- github.com/sumatrapdfreader/sumatrapdf/security/advisories/GHSA-27p6-wrfp-pgm8Exploitvia CVE List
- github.com/sumatrapdfreader/sumatrapdf/issues/5318Referencevia CVE List