CVE-2026-25920: SumatraPDF Buffer Overflow Vulnerability

CVE-2026-25920 Overview

CVE-2026-25920 is an Out-of-Bounds Read vulnerability affecting SumatraPDF, a popular multi-format document reader for Windows. In versions 3.5.2 and earlier, a heap out-of-bounds read vulnerability exists in SumatraPDF's MOBI HuffDic decompressor. The bounds check in AddCdicData() only validates half the range that DecodeOne() actually accesses, creating a dangerous security gap.

When a user opens a specially crafted .mobi file, the application can read nearly (1 << codeLength) bytes beyond the CDIC dictionary buffer, leading to an application crash. This vulnerability requires user interaction to exploit, as the victim must open a malicious MOBI file.

Critical Impact

Opening a maliciously crafted MOBI file can cause SumatraPDF to crash due to heap out-of-bounds memory access, potentially exposing sensitive memory contents or causing denial of service.

Affected Products

• SumatraPDF version 3.5.2 and earlier (Windows)
• MOBI file format processing component
• HuffDic decompressor module in MobiDoc.cpp

Discovery Timeline

• 2026-02-09 - CVE CVE-2026-25920 published to NVD
• 2026-02-11 - Last updated in NVD database

Technical Details for CVE-2026-25920

Vulnerability Analysis

This vulnerability stems from an incomplete bounds validation in the MOBI file format parser within SumatraPDF. The HuffDic (Huffman Dictionary) decompression routine used for processing MOBI e-book files contains a flaw in how it validates buffer boundaries before accessing dictionary data.

The AddCdicData() function performs bounds checking, but the validation only covers approximately half of the memory range that DecodeOne() subsequently accesses during decompression operations. This mismatch between the validated range and the actual accessed range creates an exploitable condition where memory beyond the allocated CDIC dictionary buffer can be read.

When processing a malformed MOBI file with carefully crafted dictionary entries, the decompressor can be tricked into reading up to (1 << codeLength) bytes beyond the legitimate buffer boundary. This heap-based out-of-bounds read typically results in an application crash, though it could potentially be leveraged to leak sensitive information from adjacent memory regions.

Root Cause

The root cause is CWE-125 (Out-of-bounds Read), specifically an insufficient bounds check in the AddCdicData() function within the MOBI document processing code. The function validates only a portion of the memory range that will be accessed during subsequent decoding operations, allowing DecodeOne() to access memory outside the allocated buffer boundaries.

The vulnerability exists in the MobiDoc.cpp source file where the CDIC dictionary data handling occurs.

Attack Vector

The attack requires local access with user interaction. An attacker must craft a malicious MOBI file and convince the victim to open it using SumatraPDF. The attack flow involves:

1. Attacker creates a specially crafted .mobi file with malformed CDIC dictionary entries
2. The crafted file manipulates codeLength values to maximize out-of-bounds read distance
3. Victim opens the malicious file in SumatraPDF 3.5.2 or earlier
4. During HuffDic decompression, DecodeOne() reads beyond the allocated buffer
5. Application crashes or potentially leaks memory contents

The vulnerability mechanism involves improper boundary validation in the dictionary decompression routine. For technical implementation details, refer to the GitHub Security Advisory GHSA-5mwx-65x7-cffp and the associated commit fix.

Detection Methods for CVE-2026-25920

Indicators of Compromise

• Unexpected SumatraPDF crashes when opening MOBI files
• Memory access violations or heap corruption errors in crash dumps referencing MobiDoc.cpp or HuffDic functions
• Suspicious .mobi files received via email or downloaded from untrusted sources
• Process crash events with exception codes indicating heap out-of-bounds access

Detection Strategies

• Monitor for SumatraPDF process crashes and analyze crash dumps for memory access violations in the MOBI parsing code path
• Implement file inspection rules to identify potentially malicious MOBI files with abnormal CDIC dictionary structures
• Use endpoint detection and response (EDR) solutions to track SumatraPDF behavior and detect exploitation attempts
• Deploy application allowlisting to control which document readers can process MOBI files in enterprise environments

Monitoring Recommendations

• Enable Windows Error Reporting to capture crash telemetry for SumatraPDF instances across the organization
• Configure SIEM alerts for repeated SumatraPDF crashes that may indicate exploitation attempts
• Monitor network traffic for MOBI file downloads from suspicious or untrusted sources
• Implement user behavior analytics to detect unusual document access patterns involving MOBI files

How to Mitigate CVE-2026-25920

Immediate Actions Required

• Update SumatraPDF to the latest version that includes the security fix
• Warn users against opening MOBI files from untrusted or unknown sources
• Consider temporarily blocking or quarantining MOBI file attachments in email gateways until patching is complete
• Review recent MOBI file access logs for potential exploitation attempts

Patch Information

The SumatraPDF development team has addressed this vulnerability in a security commit that corrects the bounds checking in the AddCdicData() function. Users should update to the latest available version of SumatraPDF that includes this fix.

For detailed vulnerability information, refer to the GitHub Security Advisory GHSA-5mwx-65x7-cffp.

Workarounds

• Disable or avoid opening MOBI files in SumatraPDF until the patched version is deployed
• Use alternative e-book readers that are not affected by this vulnerability for MOBI file viewing
• Implement email attachment filtering to block or scan MOBI files before delivery to end users
• Configure application control policies to prevent execution of vulnerable SumatraPDF versions

# Configuration example
# Block MOBI file associations for vulnerable SumatraPDF versions (Windows Registry)
# Remove SumatraPDF association with .mobi files until patched
reg delete "HKEY_CURRENT_USER\Software\Classes\.mobi" /f
# Alternatively, use Group Policy to restrict SumatraPDF execution
# until update deployment is complete