CVE-2026-26054Medium· 6.8▾ TwilightPoC availableSumatraPDF is a multi-format reader for Windows. Prior to 3.6, the MobiDoc::ParseHeader function in src/MobiDoc.cpp validates a record using kMobiHeaderMinLen but DecodeMobiDocHeader constructs a decoder sized for kMobiHeaderLen without …
▾ Twilight zone — High severity, or a signal on a lesser flaw
impact 37.4 · likelihood 0 · exploitation 12
A public proof-of-concept already exists for this vulnerability — see Exploit availability below.
Stakeholder-Specific Vulnerability Categorization from CISA's ADP record at CVE.org: whether exploitation is observed, whether an attack can be automated, and how much of the system is at stake. The CVSS score shown above comes from the assigning CNA record, not NVD.
Exploit-prediction probability, daily snapshots since Sep 26.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via NVD
0.1%
Last analysed / modified upstream
Exploit / PoC code exists
0.1% → 0.2%
SumatraPDF is a multi-format reader for Windows. Prior to 3.6, the MobiDoc::ParseHeader function in src/MobiDoc.cpp validates a record using kMobiHeaderMinLen but DecodeMobiDocHeader constructs a decoder sized for kMobiHeaderLen without receiving the actual remaining buffer length. A malformed MOBI file can use an attacker-controlled header length to bypass optional-field early returns and cause the decoder to read beyond a short heap buffer. Opening the crafted document can crash SumatraPDF. This issue is fixed in version 3.6.
Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Field changes observed since this record was first indexed.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-107738Medium· 6.8SumatraPDF is a multi-format reader for Windows
CVE-2026-107731Medium· 5.5SumatraPDF is a multi-format reader for Windows
CVE-2026-107729Medium· 5.5SumatraPDF is a multi-format reader for Windows
CVE-2026-107802High· 7.1SumatraPDF is a multi-format reader for Windows
CVE-2026-107737Medium· 5.7SumatraPDF is a multi-format reader for Windows
CVE-2026-107733Medium· 6.8SumatraPDF is a multi-format reader for Windows