CVE-2026-23951 is a vulnerability identified in SumatraPDF, a lightweight multi-format document reader for Windows, affecting all versions up to 3.5.2rel. The flaw arises from an off-by-one error in the validation logic within the PalmDbReader::GetRecord function, which processes Mobi eBook files. Specifically, when exactly two records are present, the validation triggers an integer underflow during size calculation due to improper bounds checking. This underflow causes the application to perform an out-of-bounds read on the heap memory, leading to a crash of the SumatraPDF process. The vulnerability is classified under CWE-125 (Out-of-bounds Read) and CWE-191 (Integer Underflow). Exploitation requires a user to open a specially crafted Mobi file, thus necessitating user interaction and local access. The vulnerability does not expose confidential data or allow code execution but results in denial of service by crashing the application. As of the publication date, no patches or fixes have been released, and no public exploits have been reported. The CVSS v3.1 score is 5.5 (medium), reflecting the limited impact and exploitation complexity. The attack vector is local (AV:L), with low attack complexity (AC:L), no privileges required (PR:N), but user interaction is necessary (UI:R). The scope remains unchanged (S:U), with no confidentiality or integrity impact but high impact on availability (A:H).

For European organizations, the primary impact of CVE-2026-23951 is denial of service due to application crashes when opening malicious Mobi files. This can disrupt workflows, especially in environments where SumatraPDF is used extensively for document reading or eBook processing, such as publishing houses, libraries, educational institutions, and legal firms. Although the vulnerability does not lead to data breaches or code execution, repeated crashes could lead to productivity loss and potential operational disruptions. Organizations relying on automated document processing or user environments where untrusted files might be opened are at higher risk. Since no known exploits are in the wild, the immediate threat is low, but the absence of patches means the vulnerability remains exploitable if attackers develop payloads. The requirement for user interaction limits remote exploitation but does not eliminate risk in scenarios involving phishing or malicious file distribution. The impact on availability could also affect business continuity if critical users or systems are targeted.

1. Avoid opening Mobi files from untrusted or unknown sources until a patch is released. 2. Implement strict email and file filtering policies to block or quarantine suspicious Mobi files. 3. Educate users about the risks of opening unsolicited or unexpected eBook files, emphasizing caution with Mobi format files. 4. Monitor SumatraPDF usage within the organization and consider restricting its use or replacing it with alternative PDF/eBook readers that are not vulnerable. 5. Employ application whitelisting and sandboxing to limit the impact of crashes and prevent potential exploitation attempts. 6. Regularly check for vendor updates or security advisories to apply patches promptly once available. 7. Use endpoint detection and response (EDR) tools to detect abnormal application crashes or suspicious file access patterns related to SumatraPDF. 8. Maintain backups and incident response plans to quickly recover from potential denial of service incidents.