CVE-2026-26054 SumatraPDF: Heap out-of-bounds read in MOBI header parser.
A heap out-of-bounds read in SumatraPDF's MOBI parser allows attackers to crash the application by opening a crafted file.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Local or same network only
- Victim action needed
- A user has to click or open something
- Fix
- None listed
What is CVE-2026-26054?
CVE-2026-26054 is a medium-severity memory corruption vulnerability in sumatrapdfreader sumatrapdf, published on 24 Sep 2026. It can only be exploited from the same machine or local network, and only if a user opens a file or follows a link.
Official description
SumatraPDF is a multi-format reader for Windows. Prior to 3.6, the MobiDoc::ParseHeader function in src/MobiDoc.cpp validates a record using kMobiHeaderMinLen but DecodeMobiDocHeader constructs a decoder sized for kMobiHeaderLen without receiving the actual remaining buffer length. A malformed MOBI file can use an attacker-controlled header length to bypass optional-field early returns and cause the decoder to read beyond a short heap buffer. Opening the crafted document can crash SumatraPDF. This issue is fixed in version 3.6.
Weakness: CWE-125
Which versions are affected by CVE-2026-26054?
How do I fix CVE-2026-26054?
No fix has been published for CVE-2026-26054 yet. Limit exposure of the affected software until one is available.
Upgrade to the fixed version. Memory-safe languages, compiler hardening and fuzzing prevent most new cases. More about Memory corruption.
Is CVE-2026-26054 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-26054 exists.
Sources
Also known as GHSA-27p6-wrfp-pgm8.