CVE-2026-26054: SumatraPDF: Heap out-of-bounds read in MOBI header parser.
SumatraPDF is a multi-format reader for Windows. Prior to 3.6, the MobiDoc::ParseHeader function in src/MobiDoc.cpp validates a record using kMobiHeaderMinLen but DecodeMobiDocHeader constructs a decoder sized for kMobiHeaderLen without receiving the actual remaining buffer length. A malformed MOBI file can use an attacker-controlled header length to bypass optional-field early returns and cause the decoder to read beyond a short heap buffer. Opening the crafted document can crash SumatraPDF. This issue is fixed in version 3.6.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
SumatraPDFto a version that resolves this vulnerability.Fixed in 3.6
Event History
Frequently Asked Questions
Which installations are affected?
SumatraPDF versions prior to 3.6 are affected. The issue is fixed in version 3.6.
What does an attacker need to exploit this issue?
An attacker needs to provide a malformed MOBI document with an attacker-controlled header length and have it opened in SumatraPDF.
Are users affected under the default document-opening workflow?
Yes. The described trigger is opening a crafted MOBI file; no additional configuration requirement is identified.
What is the observed impact?
Opening the crafted document can cause SumatraPDF to read beyond a short heap buffer and crash.
What should be done if an upgrade cannot be applied immediately?
Do not open untrusted MOBI files with affected SumatraPDF versions until version 3.6 can be deployed.