CVE-2026-25920 | BDVDB-2026-314561 Detail

Description#

SumatraPDF is a multi-format reader for Windows. In 3.5.2 and earlier, a heap out-of-bounds read vulnerability exists in SumatraPDF's MOBI HuffDic decompressor. The bounds check in AddCdicData() only validates half the range that DecodeOne() actually accesses. Opening a crafted .mobi file can read nearly (1 << codeLength) bytes beyond the CDIC dictionary buffer, leading to a crash.

Impact#

Weaknesses#

References#

Exploit#

History#

1. Version 12026-02-09Record published in the CVE List.
2. Version 22026-02-11Most recent update recorded in the CVE List.