What is the CVSS score of CVE-2026-23951?

CVE-2026-23951 has a CVSS 3.1 base score of 5.5 (Medium). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H. EPSS exploitation probability: 0.0%.

Which versions of Windows are affected by CVE-2026-23951?

Organizations using SumatraPDF should be aware of moderate risk from CVE-2026-23951, a out-of-bounds read vulnerability rated CVSS 5.5.

Is there a public PoC exploit available for CVE-2026-23951?

Yes, a public proof-of-concept exploit is available for CVE-2026-23951. Prioritise patching immediately. EPSS: 0.0%.

How to fix or mitigate CVE-2026-23951?

Within 30 days: Identify affected systems and apply vendor patches as part of regular patch cycle. Monitor vendor channels for patch availability.

Windows CVE-2026-23951

MEDIUM

Out-of-bounds Read (CWE-125)

2026-01-22 security-advisories@github.com

Windows Denial Of Service Integer Overflow Sumatrapdf Sumatrapdfreader

5.5

CVSS 3.1 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

5.5 MEDIUM

AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

Primary rating from GitHub Advisory · only source for this CVE.

CVSS VectorGitHub Advisory

Attack Vector

Local

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

Lifecycle Timeline

Analysis Generated

Mar 12, 2026 - 21:54 vuln.today

PoC Detected

Feb 17, 2026 - 16:48 vuln.today

Public exploit code

CVE Published

Jan 22, 2026 - 01:15 nvd

MEDIUM 5.5

DescriptionGitHub Advisory

SumatraPDF is a multi-format reader for Windows. All versions contain an off-by-one error in the validation code that only triggers with exactly 2 records, causing an integer underflow in the size calculation. This bug exists in PalmDbReader::GetRecord when opening a crafted Mobi file, resulting in an out-of-bounds heap read that crashes the app. There are no published fixes at the time of publication.

AnalysisAI

SumatraPDF on Windows is vulnerable to a denial-of-service attack through a maliciously crafted Mobi file that triggers an integer underflow in record validation, causing an out-of-bounds heap read and application crash. The vulnerability stems from an off-by-one error in the PalmDbReader::GetRecord function that only occurs with exactly 2 records, and public exploit code is available. No patch has been released at this time.

Technical ContextAI

Classified as CWE-125 (Out-of-bounds Read). Affects Sumatrapdf. SumatraPDF is a multi-format reader for Windows. All versions contain an off-by-one error in the validation code that only triggers with exactly 2 records, causing an integer underflow in the size calculation. This bug exists in PalmDbReader::GetRecord when opening a crafted Mobi file, resulting in an out-of-bounds heap read that crashes the app. There are no published fixes at the time of publication.