SumatraPDF CVE-2026-26054

Requires the victim to open a specially crafted malformed MOBI (Mobipocket e-book) file in SumatraPDF prior to version 3.6; the malicious file must supply an attacker-controlled MOBI header length that bypasses the optional-field early returns in DecodeMobiDocHeader so the decoder over-reads a short heap buffer. Exploitation is limited by requiring local file delivery and user interaction (the user must actively open the document - passive UI:P), affects only the MOBI code path (not PDF or other formats), and yields only a crash of the client application. No authentication or special configuration is needed beyond opening the file.

This is a memory-safety bug (CWE-125 out-of-bounds heap read) in SumatraPDF's MOBI parser, and every available signal points to it being a LOW real-world priority despite the 6.8 CVSS 4.0 score. The impact is confined to availability: the vendor vector (AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H) explicitly sets confidentiality and integrity to None - the only outcome is a crash when the crafted document is opened, so this is a client-side denial-of-service, not code execution or data theft. Exploitation is local (AV:L) and requires the victim to actively open an attacker-supplied MOBI file (UI:P/passive user interaction), which sharply limits automatability and scale. There is no EPSS score, no CISA KEV listing, and no public proof-of-concept in the provided data, so exploitation status is 'no public exploit identified at time of analysis.' The description's phrase 'read beyond a short heap buffer' could in principle enable information disclosure, but the vendor scored VC:N and the observed effect is a crash - so the 'Information Disclosure' tag overstates confirmed impact. Net: a genuine but low-severity DoS bug, already fixed, not a widespread-exploitation concern.

An attacker crafts a malformed MOBI e-book whose header declares an attacker-controlled length, bypassing the optional-field early-return checks so DecodeMobiDocHeader reads past the end of a short heap allocation. The attacker delivers this file via email, download, or a shared library, and when the victim opens it in a vulnerable SumatraPDF (prior to 3.6), the application crashes. No public proof-of-concept is identified in the provided data, and the reproducer is described only in the linked GitHub issue/advisory.