CVE-2026-26054: SumatraPDF Buffer Overflow Vulnerability

CVE-2026-26054 Overview

CVE-2026-26054 is an out-of-bounds read vulnerability [CWE-125] in SumatraPDF, a multi-format document reader for Windows. The flaw resides in the MobiDoc::ParseHeader function within src/MobiDoc.cpp. The function validates incoming records using kMobiHeaderMinLen, but DecodeMobiDocHeader constructs a decoder sized for kMobiHeaderLen without receiving the actual remaining buffer length. A malformed MOBI file can supply an attacker-controlled header length that bypasses optional-field early returns. The decoder then reads past the end of a short heap buffer, crashing SumatraPDF when the crafted document is opened. The issue is fixed in SumatraPDF version 3.6.

Critical Impact
Opening a crafted MOBI file triggers an out-of-bounds heap read that crashes SumatraPDF, enabling a local denial-of-service condition.

Affected Products

SumatraPDF versions prior to 3.6
SumatraPDF MOBI document parser (src/MobiDoc.cpp)
Windows installations using vulnerable SumatraPDF builds

Discovery Timeline

2026-09-24 - CVE-2026-26054 published to the National Vulnerability Database (NVD)
2026-09-28 - Last updated in NVD database

Technical Details for CVE-2026-26054

Vulnerability Analysis

The vulnerability is an out-of-bounds read in SumatraPDF's MOBI document parser. MobiDoc::ParseHeader enforces a minimum record length using kMobiHeaderMinLen. The length check does not match the fixed size assumed later in processing. DecodeMobiDocHeader constructs a ByteOrderDecoder using the compile-time constant kMobiHeaderLen instead of the actual remaining buffer length passed in by the caller.

When the attacker-controlled hdrLen field permits optional-field parsing to continue past the normal early-return guard, the decoder consumes bytes beyond the end of the heap allocation. This leads to a heap-based out-of-bounds read and a process crash. User interaction is required because the victim must open the malformed MOBI file.

Root Cause

The root cause is a mismatch between the validated buffer length and the length used by the decoder. The caller validates with kMobiHeaderMinLen, but the decoder assumes kMobiHeaderLen bytes are available. No propagation of the true remaining buffer length allowed the decoder to walk off the end of a shorter allocation. This is a classic input validation failure leading to [CWE-125] Out-of-Bounds Read.

Attack Vector

Exploitation requires an attacker to deliver a crafted MOBI document to a local user and convince them to open it in a vulnerable SumatraPDF build. Delivery vectors include email attachments, drive-by downloads, and shared file repositories. The impact is limited to a crash of the SumatraPDF process, producing a denial-of-service condition on the user's workstation.

cpp

// Patch excerpt from src/MobiDoc.cpp (SumatraPDF 3.6)
// Source: https://github.com/sumatrapdfreader/sumatrapdf/commit/24b9ce83383bbaa48b3efe00e4d30cccea126198

-static void DecodeMobiDocHeader(const u8* buf, MobiHeader* hdr) {
+static void DecodeMobiDocHeader(const u8* buf, size_t bufLen, MobiHeader* hdr) {
     memset(hdr, 0, sizeof(MobiHeader));
     hdr->drmEntriesCount = (u32)-1;

-    ByteOrderDecoder d(buf, kMobiHeaderLen, ByteOrderDecoder::BigEndian);
+    size_t decLen = std::min(bufLen, (size_t)kMobiHeaderLen);
+    ByteOrderDecoder d(buf, decLen, ByteOrderDecoder::BigEndian);
     d.Bytes(hdr->id, 4);
     hdr->hdrLen = d.UInt32();
     hdr->type = d.UInt32();

The fix adds a bufLen parameter and clamps the decoder length to the smaller of the caller-provided buffer size and kMobiHeaderLen, preventing reads past the allocation boundary.

Detection Methods for CVE-2026-26054

Indicators of Compromise

Unexpected crashes of SumatraPDF.exe shortly after a user opens a .mobi, .prc, or .azw file
Windows Error Reporting (WER) entries referencing SumatraPDF.exe with access violation faults in MOBI parsing code paths
MOBI files received from untrusted sources with abnormally small record sizes or inconsistent hdrLen values

Detection Strategies

Inventory endpoints for SumatraPDF versions earlier than 3.6 using software asset management or EDR telemetry
Hunt for process crash events where SumatraPDF.exe terminated abnormally after loading a document file
Inspect file-handler telemetry for MOBI documents originating from email gateways or external file shares

Monitoring Recommendations

Forward Windows Application and WER event logs to a central SIEM to correlate SumatraPDF crashes with file-open events
Alert on repeated SumatraPDF crash events on the same host, which may indicate repeated exploitation attempts
Monitor email and web proxy logs for inbound MOBI attachments and downloads from low-reputation sources

How to Mitigate CVE-2026-26054

Immediate Actions Required

Upgrade all SumatraPDF installations to version 3.6 or later, available from the SumatraPDF 3.6 release
Block or quarantine unsolicited MOBI, PRC, and AZW attachments at the email gateway until patching is complete
Advise users not to open MOBI files received from untrusted sources

Patch Information

The fix is included in SumatraPDF 3.6. The code change in commit 24b9ce8 adds a bufLen parameter to DecodeMobiDocHeader and clamps the decoder length. Additional context is documented in the GitHub Security Advisory GHSA-27p6-wrfp-pgm8 and GitHub issue #5318.

Workarounds

Associate MOBI, PRC, and AZW file extensions with an alternative reader until SumatraPDF is upgraded
Restrict SumatraPDF execution via application control policies (for example, Windows Defender Application Control) on hosts that cannot be patched immediately
Enforce attachment filtering rules that strip or quarantine inbound MOBI-family files from external senders

bash

# PowerShell example: locate SumatraPDF binaries and report versions below 3.6
Get-ChildItem -Path 'C:\','D:\' -Recurse -Filter 'SumatraPDF.exe' -ErrorAction SilentlyContinue |
  ForEach-Object {
    $v = (Get-Item $_.FullName).VersionInfo.FileVersion
    [PSCustomObject]@{ Path = $_.FullName; Version = $v }
  } | Where-Object { $_.Version -lt '3.6' }