CVE-2026-25920: SumatraPDF Buffer Overflow Vulnerability

CVE-2026-25920 Overview

CVE-2026-25920 is an Out-of-Bounds Read vulnerability affecting SumatraPDF, a popular multi-format document reader for Windows. In versions 3.5.2 and earlier, a heap out-of-bounds read vulnerability exists in SumatraPDF's MOBI HuffDic decompressor. The bounds check in AddCdicData() only validates half the range that DecodeOne() actually accesses, creating a dangerous security gap.

When a user opens a specially crafted .mobi file, the application can read nearly (1 << codeLength) bytes beyond the CDIC dictionary buffer, leading to an application crash. This vulnerability requires user interaction to exploit, as the victim must open a malicious MOBI file.

Critical Impact
Opening a maliciously crafted MOBI file can cause SumatraPDF to crash due to heap out-of-bounds memory access, potentially exposing sensitive memory contents or causing denial of service.

Affected Products

SumatraPDF version 3.5.2 and earlier (Windows)
MOBI file format processing component
HuffDic decompressor module in MobiDoc.cpp

Discovery Timeline

2026-02-09 - CVE CVE-2026-25920 published to NVD
2026-02-11 - Last updated in NVD database

Technical Details for CVE-2026-25920

Vulnerability Analysis

This vulnerability stems from an incomplete bounds validation in the MOBI file format parser within SumatraPDF. The HuffDic (Huffman Dictionary) decompression routine used for processing MOBI e-book files contains a flaw in how it validates buffer boundaries before accessing dictionary data.

The AddCdicData() function performs bounds checking, but the validation only covers approximately half of the memory range that DecodeOne() subsequently accesses during decompression operations. This mismatch between the validated range and the actual accessed range creates an exploitable condition where memory beyond the allocated CDIC dictionary buffer can be read.

When processing a malformed MOBI file with carefully crafted dictionary entries, the decompressor can be tricked into reading up to (1 << codeLength) bytes beyond the legitimate buffer boundary. This heap-based out-of-bounds read typically results in an application crash, though it could potentially be leveraged to leak sensitive information from adjacent memory regions.

Root Cause

The root cause is CWE-125 (Out-of-bounds Read), specifically an insufficient bounds check in the AddCdicData() function within the MOBI document processing code. The function validates only a portion of the memory range that will be accessed during subsequent decoding operations, allowing DecodeOne() to access memory outside the allocated buffer boundaries.

The vulnerability exists in the MobiDoc.cpp source file where the CDIC dictionary data handling occurs.

Attack Vector

The attack requires local access with user interaction. An attacker must craft a malicious MOBI file and convince the victim to open it using SumatraPDF. The attack flow involves:

Attacker creates a specially crafted .mobi file with malformed CDIC dictionary entries
The crafted file manipulates codeLength values to maximize out-of-bounds read distance
Victim opens the malicious file in SumatraPDF 3.5.2 or earlier
During HuffDic decompression, DecodeOne() reads beyond the allocated buffer
Application crashes or potentially leaks memory contents

The vulnerability mechanism involves improper boundary validation in the dictionary decompression routine. For technical implementation details, refer to the GitHub Security Advisory GHSA-5mwx-65x7-cffp and the associated commit fix.

Detection Methods for CVE-2026-25920

Indicators of Compromise

Unexpected SumatraPDF crashes when opening MOBI files
Memory access violations or heap corruption errors in crash dumps referencing MobiDoc.cpp or HuffDic functions
Suspicious .mobi files received via email or downloaded from untrusted sources
Process crash events with exception codes indicating heap out-of-bounds access

Detection Strategies

Monitor for SumatraPDF process crashes and analyze crash dumps for memory access violations in the MOBI parsing code path
Implement file inspection rules to identify potentially malicious MOBI files with abnormal CDIC dictionary structures
Use endpoint detection and response (EDR) solutions to track SumatraPDF behavior and detect exploitation attempts
Deploy application allowlisting to control which document readers can process MOBI files in enterprise environments

Monitoring Recommendations

Enable Windows Error Reporting to capture crash telemetry for SumatraPDF instances across the organization
Configure SIEM alerts for repeated SumatraPDF crashes that may indicate exploitation attempts
Monitor network traffic for MOBI file downloads from suspicious or untrusted sources
Implement user behavior analytics to detect unusual document access patterns involving MOBI files

How to Mitigate CVE-2026-25920

Immediate Actions Required

Update SumatraPDF to the latest version that includes the security fix
Warn users against opening MOBI files from untrusted or unknown sources
Consider temporarily blocking or quarantining MOBI file attachments in email gateways until patching is complete
Review recent MOBI file access logs for potential exploitation attempts

Patch Information

The SumatraPDF development team has addressed this vulnerability in a security commit that corrects the bounds checking in the AddCdicData() function. Users should update to the latest available version of SumatraPDF that includes this fix.

For detailed vulnerability information, refer to the GitHub Security Advisory GHSA-5mwx-65x7-cffp.

Workarounds

Disable or avoid opening MOBI files in SumatraPDF until the patched version is deployed
Use alternative e-book readers that are not affected by this vulnerability for MOBI file viewing
Implement email attachment filtering to block or scan MOBI files before delivery to end users
Configure application control policies to prevent execution of vulnerable SumatraPDF versions

bash

# Configuration example
# Block MOBI file associations for vulnerable SumatraPDF versions (Windows Registry)
# Remove SumatraPDF association with .mobi files until patched
reg delete "HKEY_CURRENT_USER\Software\Classes\.mobi" /f
# Alternatively, use Group Policy to restrict SumatraPDF execution
# until update deployment is complete