PT-2026-98141 · Unknown · Sumatrapdf
CVE-2026-26054
·
Published
2026-02-11
·
Updated
2026-09-28
CVSS v4.0
6.8
Medium
| Vector | AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X |
Name of the Vulnerable Software and Affected Versions
SumatraPDF versions prior to 3.6
Description
The
MobiDoc::ParseHeader() function in src/MobiDoc.cpp validates records using kMobiHeaderMinLen, while DecodeMobiDocHeader() creates a decoder sized for kMobiHeaderLen without verifying the actual remaining buffer length. A specially crafted MOBI file can utilize an attacker-controlled header length to bypass optional-field early returns, leading to an out-of-bounds read from a short heap buffer. This can result in an application crash when the document is opened.Recommendations
Update to version 3.6.
Exploit
Fix
Out of bounds Read
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Sumatrapdf