CVE-2026-26054

SumatraPDF is a multi-format reader for Windows. Prior to 3.6, the MobiDoc::ParseHeader function in src/MobiDoc.cpp validates a record using kMobiHeaderMinLen but DecodeMobiDocHeader constructs a decoder sized for kMobiHeaderLen without receiving the actual remaining buffer length. A malformed MOBI file can use an attacker-controlled header length to bypass optional-field early returns and cause the decoder to read beyond a short heap buffer. Opening the crafted document can crash SumatraPDF. This issue is fixed in version 3.6.

• CWE-125

• https://github.com/sumatrapdfreader/sumatrapdf/commit/24b9ce83383bbaa48b3efe00e4d30cccea126198
• https://github.com/sumatrapdfreader/sumatrapdf/issues/5318
• https://github.com/sumatrapdfreader/sumatrapdf/releases/tag/3.6rel
• https://github.com/sumatrapdfreader/sumatrapdf/security/advisories/GHSA-27p6-wrfp-pgm8

Published

Sep 24, 2026

Last Modified

Sep 24, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-26048The Wi-Fi router is vulnerable to de-authentication attacks …7.5
• CVE-2026-26049The web management interface of the device renders the passw…5.7
• CVE-2026-2605Tanium addressed an insertion of sensitive information into …5.3
• CVE-2026-26050The installer for ジョブログ集計/分析ソフトウェア RICOHジョブログ集計ツール versions …8.4
• CVE-2026-26051WebSocket endpoints lack proper authentication mechanisms, e…9.8
• CVE-2026-26053An Incorrect Privilege Assignment (CWE-266) vulnerability in…5.3
• CVE-2026-26055Yoke is a Helm-inspired infrastructure-as-code (IaC) package…7.5
• CVE-2026-26056Yoke is a Helm-inspired infrastructure-as-code (IaC) package…8.8
• CVE-2026-26057Skill Scanner is a security scanner for AI Agent Skills that…9.1
• CVE-2026-26058Zulip is an open-source team collaboration tool. From versio…6.1
• CVE-2026-26059ChurchCRM is an open-source church management system. In ver…5.4
• CVE-2026-2606IBM webMethods API Gateway (on-prem) 10.11 through 10.11_Fix…6.5