{"id":"CVE-2026-26054","revision":"b47bca8c16e6450db0a0cabae2fe94e6","records":[{"revision":"b47bca8c16e6450db0a0cabae2fe94e6","observedAt":"2026-10-23T15:48:27.903+00:00","statement":{"source":"cve-program","id":"CVE-2026-26054","aliases":[],"title":"SumatraPDF: Heap out-of-bounds read in MOBI header parser.","description":"SumatraPDF is a multi-format reader for Windows. Prior to 3.6, the MobiDoc::ParseHeader function in src/MobiDoc.cpp validates a record using kMobiHeaderMinLen but DecodeMobiDocHeader constructs a decoder sized for kMobiHeaderLen without receiving the actual remaining buffer length. A malformed MOBI file can use an attacker-controlled header length to bypass optional-field early returns and cause the decoder to read beyond a short heap buffer. Opening the crafted document can crash SumatraPDF. This issue is fixed in version 3.6.","state":0,"publishedAt":"2026-09-24T16:48:03.247+00:00","modifiedAt":"2026-09-28T15:33:32.202+00:00","affected":[{"ecosystem":"Vendor product","name":"sumatrapdf","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"vendor\": \"sumatrapdfreader\",\n                    \"product\": \"sumatrapdf\",\n                    \"versions\": [\n                        {\n                            \"version\": \"< 3.6\",\n                            \"status\": \"affected\"\n                        }\n                    ]\n                }"}],"metrics":[{"system":"CVSS 4.0","vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","score":6.8,"severity":"MEDIUM"}],"references":["https://github.com/sumatrapdfreader/sumatrapdf/security/advisories/GHSA-27p6-wrfp-pgm8","https://github.com/sumatrapdfreader/sumatrapdf/issues/5318","https://github.com/sumatrapdfreader/sumatrapdf/commit/24b9ce83383bbaa48b3efe00e4d30cccea126198","https://github.com/sumatrapdfreader/sumatrapdf/releases/tag/3.6rel"],"sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-26054","license":"CVE Program Terms of Use","key":"cve-program:CVE-2026-26054","identifiers":["CVE-2026-26054"]},"retained":false,"historicalAffected":[]}],"coverage":[]}