CVE-2026-25920

SumatraPDF is a multi-format reader for Windows. In 3.5.2 and earlier, a heap out-of-bounds read vulnerability exists in SumatraPDF's MOBI HuffDic decompressor. The bounds check in AddCdicData() only validates half the range that DecodeOne() actually accesses. Opening a crafted .mobi file can read nearly (1 << codeLength) bytes beyond the CDIC dictionary buffer, leading to a crash.

• CWE-125

• https://github.com/sumatrapdfreader/sumatrapdf/blob/916392f94bc34e24f3c3286893ac6d7fa1e1c428/src/MobiDoc.cppProduct
• https://github.com/sumatrapdfreader/sumatrapdf/commit/12b6887e9dfff874fe8749bab1bdc53d4ff075b3Product
• https://github.com/sumatrapdfreader/sumatrapdf/security/advisories/GHSA-5mwx-65x7-cffpExploit, Vendor Advisory

Published

Feb 9, 2026

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-25907Dell PowerScale OneFS, version 9.13.0.0, contains an overly …7.5
• CVE-2026-25908Dell Alienware Command Center (AWCC), versions prior to 6.13…7.8
• CVE-2026-25916Roundcube Webmail before 1.5.13 and 1.6 before 1.6.13, when …4.3
• CVE-2026-25917Dag Authors, who normally should not be able to execute code…7.2
• CVE-2026-25918unity-cli is a command line utility for the Unity Game Engin…5.5
• CVE-2026-2592The Zarinpal Gateway for WooCommerce plugin for WordPress is…7.7
• CVE-2026-25921Gogs is an open source self-hosted Git service. Prior to ver…9.3
• CVE-2026-25922authentik is an open-source identity provider. Prior to 2025…8.8
• CVE-2026-25923my little forum is a PHP and MySQL based internet forum that…9.1
• CVE-2026-25924Kanboard is project management software focused on Kanban me…8.4
• CVE-2026-25925PowerDocu contains a Windows GUI executable to perform techn…7.8
• CVE-2026-25926Notepad++ is a free and open-source source code editor. An U…7.3