CVE-2026-23951
📋 TL;DR
SumatraPDF contains an off-by-one error when processing specially crafted Mobi files, causing an integer underflow that leads to an out-of-bounds heap read and application crash. This affects all Windows users who open untrusted Mobi files with SumatraPDF. The vulnerability requires user interaction to open a malicious file.
💻 Affected Systems
- SumatraPDF
📦 What is this software?
Sumatrapdf by Sumatrapdfreader
⚠️ Risk & Real-World Impact
Worst Case
Arbitrary code execution if the out-of-bounds read can be leveraged for memory corruption attacks, though this is not confirmed in the advisory.
Likely Case
Denial of service through application crash when opening a malicious Mobi file.
If Mitigated
No impact if users only open trusted files or if Mobi file support is disabled.
🎯 Exploit Status
Exploitation requires user interaction to open a crafted Mobi file. No public exploit code is available at time of advisory.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: None
Vendor Advisory: https://github.com/sumatrapdfreader/sumatrapdf/security/advisories/GHSA-hj4w-c5x8-p2hv
Restart Required: No
Instructions:
No official patch available. Monitor the GitHub repository for updates and patch when available.
🔧 Temporary Workarounds
Disable Mobi file association
windowsRemove SumatraPDF as the default handler for .mobi files to prevent automatic opening
Control Panel > Default Programs > Set Default Programs > Select SumatraPDF > Choose defaults for this program > Uncheck .mobi
Use alternative PDF reader for Mobi files
windowsConfigure system to use a different application for opening Mobi files
Right-click .mobi file > Open with > Choose another app > Select alternative reader > Check 'Always use this app'
🧯 If You Can't Patch
- Avoid opening Mobi files from untrusted sources with SumatraPDF
- Use file integrity monitoring to detect unexpected Mobi files in user directories
🔍 How to Verify
Check if Vulnerable:
Check if SumatraPDF is installed and associated with .mobi filesCheck Version:
SumatraPDF.exe -versionVerify Fix Applied:
Check for updated version when patch becomes available📡 Detection & Monitoring
Log Indicators:
- Application crash logs from SumatraPDF
- Windows Event Logs showing application faults
Network Indicators:
- Unusual Mobi file downloads from untrusted sources
SIEM Query:
EventID=1000 OR EventID=1001 AND SourceName='Application Error' AND ProcessName='SumatraPDF.exe'