CVE-2026-26054— SumatraPDF: Heap out-of-bounds read in MOBI header parser.
Quick assessment
Affected
sumatrapdfreader sumatrapdf
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
SumatraPDF 是一款面向 Windows 的多格式文档阅读器。在 3.6 版本之前，位于 src/MobiDoc.cpp 中的 MobiDoc::ParseHeader 函数使用 kMobiHeaderMinLen 对记录进行验证，但 DecodeMobiDocHeader 在构造解码器时，其大小设定为 kMobiHeaderLen，且未获取实际的剩余缓冲区长度。恶意构造的 MOBI 文件可利用攻击者控制的头长度字段，绕过可选字段的早期返回逻辑，从而导致解码器读取超出短堆缓冲区的边界。打开精心构造的文档可能
Possible ATT&CK Techniques 1 AI
T1203 · Exploitation for Client ExecutionAffected Version Matrix 1
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| sumatrapdfreader | sumatrapdf | < 3.6 |
affected |
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-26054
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
SumatraPDF: Heap out-of-bounds read in MOBI header parser.
Source: CVE Program / CVE List V5
Vulnerability Description
SumatraPDF is a multi-format reader for Windows. Prior to 3.6, the MobiDoc::ParseHeader function in src/MobiDoc.cpp validates a record using kMobiHeaderMinLen but DecodeMobiDocHeader constructs a decoder sized for kMobiHeaderLen without receiving the actual remaining buffer length. A malformed MOBI file can use an attacker-controlled header length to bypass optional-field early returns and cause the decoder to read beyond a short heap buffer. Opening the crafted document can crash SumatraPDF. This issue is fixed in version 3.6.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
Source: CVE Program / CVE List V5
Vulnerability Type
跨界内存读
Source: CVE Program / CVE List V5
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| sumatrapdfreader | sumatrapdf | < 3.6 | - |
|
II. Public POCs for CVE-2026-26054
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-26054
请登录查看更多情报信息。
Patches & Fixes for CVE-2026-26054 (2)
-
🔗 crash in mobi file · Issue #5318 · sumatrapdfreader/sumatrapdf x_refsource_MISC
-
Vendor Advisories for CVE-2026-26054 (1)
Vendor Pages for CVE-2026-26054 (1)
-
🔗 Release 3.6 release · sumatrapdfreader/sumatrapdf · GitHub x_refsource_MISC
IV. Related Vulnerabilities
Same product: sumatrapdf
-
CVE-2026-107802
SumatraPDF — Windows command-line argument injection in AI s -
CVE-2026-107738
SumatraPDF: Untrusted binary record offset used without lowe -
CVE-2026-107737
SumatraPDF CHM `its://` signed index causes an out-of-bounds -
CVE-2026-107736
SumatraPDF: stack buffer overflow while processing EXIF Orie -
CVE-2026-107735
SumatraPDF: `sumatrapdfrestrict.ini` never revokes any permi
Same vendor: sumatrapdfreader
-
CVE-2026-107802
SumatraPDF — Windows command-line argument injection in AI s -
CVE-2026-107738
SumatraPDF: Untrusted binary record offset used without lowe -
CVE-2026-107737
SumatraPDF CHM `its://` signed index causes an out-of-bounds -
CVE-2026-107736
SumatraPDF: stack buffer overflow while processing EXIF Orie -
CVE-2026-107735
SumatraPDF: `sumatrapdfrestrict.ini` never revokes any permi
Same weakness: CWE-125
-
CVE-2026-107837
RIOT: Out-of-Bounds Read in RIOT OS 6LoWPAN SFF Fragment Han -
CVE-2026-107836
RIOT: nanoCoAP Block2 client slice handling underflows on in -
CVE-2026-107817
MariaDB: mysql_json plugin OOB reads -
CVE-2026-107816
MariaDB: `qc_info` plugin can do OOB reads if query contains -
CVE-2026-108103
Open5GS through 2.8.0 Heap Out-of-Bounds Read via PFCP Dropp
V. Comments for CVE-2026-26054
No comments yet