CVE-2026-26054: Sumatrapdfreader Sumatrapdf

Medium severity, CVSS 6.8. EPSS: 0.1% chance of exploitation in the next 30 days.

SumatraPDF is a multi-format reader for Windows. Prior to 3.6, the MobiDoc::ParseHeader function in src/MobiDoc.cpp validates a record using kMobiHeaderMinLen but DecodeMobiDocHeader constructs a decoder sized for kMobiHeaderLen without receiving the actual remaining buffer length. A malformed MOBI file can use an attacker-controlled header length to bypass optional-field early returns and cause the decoder to read beyond a short heap buffer. Opening the crafted document can crash SumatraPDF. This issue is fixed in version 3.6.

Affected products

• Sumatrapdfreader Sumatrapdf: before 3.6 (fixed in 3.6)

Published 2026-09-24. Last modified 2026-09-28.