Threat Intelligence Database

SumatraPDF is a multi-format reader for Windows. Prior to 3.6, the MobiDoc::ParseHeader function in src/MobiDoc.cpp validates a record using kMobiHeaderMinLen but DecodeMobiDocHeader constructs a decoder sized for kMobiHeaderLen without receiving the actual remaining buffer length. A malformed MOBI file can use an attacker-controlled header length to bypass optional-field early returns and cause the decoder to read beyond a short heap buffer. Opening the crafted document can crash SumatraPDF. This issue is fixed in version 3.6.

SumatraPDF version 3.6.1 has an integer overflow vulnerability in the function EngineMupdf::BuildPageLabelRec() when parsing PDF PageLabels /Nums entries. This flaw can cause a denial of service by crashing the application. The vulnerability has a high severity rating with a CVSS score of 7.5. No patch or official fix information is currently available.

SumatraPDF versions 3.6.1 and earlier contain a heap memory corruption vulnerability in the CHM file parser. A crafted CHM file with malformed LZX Huffman code lengths can cause out-of-bounds writes in the decompression code, leading to heap corruption. While arbitrary code execution has not been demonstrated, the flaw poses a risk of memory corruption during parsing. No fixed version is currently available.

CVE-2026-23951 is a medium severity vulnerability in SumatraPDF (versions up to 3.5.2rel) caused by an off-by-one error in PalmDbReader::GetRecord when processing crafted Mobi files. This leads to an integer underflow during size calculation, resulting in an out-of-bounds heap read that crashes the application. Exploitation requires local access and user interaction to open a malicious file, with no impact on confidentiality or integrity, only availability. No patches are currently available, and no known exploits exist in the wild. European organizations using SumatraPDF for document reading may experience denial of service if targeted. Mitigation involves avoiding opening untrusted Mobi files and monitoring for updates from the vendor. Countries with higher usage of SumatraPDF and significant document handling needs, such as Germany, France, and the UK, are most likely to be affected.

MediumVulnerabilityGermanyFranceItaly+5#cve#cve-2026-23951#cwe-125

SumatraPDF is a multi-format reader for Windows. In 3.5.2 and earlier, there is a Untrusted Search Path vulnerability when Advanced Options setting is trigger. The application executes notepad.exe without specifying an absolute path when using the Advanced Options setting. On Windows, this allows execution of a malicious notepad.exe placed in the application's installation directory, leading to arbitrary code execution.

HighVulnerabilityGermanyFranceUnited Kingdom+7#cve#cve-2026-23512#cwe-426