CVE-2026-23951: 
SumatraPDF vulnerability analysis and mitigation

CVE-2026-23951 is an integer underflow vulnerability in SumatraPDF's PalmDbReader::GetRecord function that causes an out-of-bounds heap read and application crash when opening a specially crafted Mobi file. All versions of SumatraPDF up to and including 3.5.2rel are affected. The vulnerability was published on January 22, 2026, with a security advisory issued by the project maintainer on January 19, 2026. It carries a CVSS v3.1 base score of 5.5 (Medium) (GitHub Advisory, Red Hat CVE).

The vulnerability stems from two cooperating bugs classified as CWE-193 (Off-by-One Error), CWE-191 (Integer Underflow), and CWE-125 (Out-of-bounds Read). In PdbReader::ParseHeader, the offset validation loop iterates from i = 1 to i < nRecs - 1, meaning when nRecs = 2, the loop condition i < 1 is immediately false and the loop body never executes — allowing a file with inverted record offsets to pass validation. Subsequently, in PdbReader::GetRecord, the size calculation size = nextOff - off wraps around to a massive value (e.g., 0xFFFFFFFFFFFFFFCE) when off > nextOff, because the bounds check only logs via ReportIf without aborting. Downstream functions such as MobiDoc::ParseHeader and DecodeExthHeader then attempt to read this enormous size from heap memory, triggering a crash. Exploitation requires a local attacker to deliver a crafted .mobi file and convince a user to open it in SumatraPDF (GitHub Advisory, PalmDbReader Source).

Successful exploitation results in a denial-of-service condition via application crash (DoS). There is no impact on confidentiality or data integrity — the vulnerability cannot be used to execute arbitrary code or access sensitive information based on current analysis. The scope is limited to the SumatraPDF process on the local Windows system, with no potential for lateral movement or privilege escalation (GitHub Advisory).

A proof-of-concept (PoC) Python script (generate_poc.py) is publicly available in the GitHub security advisory, which generates a crash.mobi file that reliably triggers the crash. There is no evidence of in-the-wild exploitation at this time, and no threat actor attribution has been reported. The EPSS score is approximately 0.013% (0.000130), reflecting very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog (GitHub Advisory).

1. Craft the malicious file: Run the publicly available generate_poc.py PoC script from the GitHub advisory. The script creates a crash.mobi file with a PDB header declaring exactly 2 records, where record 0 is assigned offset 200 and record 1 is assigned offset 150 (inverted order).
2. Bypass validation: Because nRecs = 2, the offset validation loop in PdbReader::ParseHeader never executes (loop condition i < 1 is false from the start), allowing the malformed file with inverted offsets to pass all checks.
3. Trigger integer underflow: When SumatraPDF calls PdbReader::GetRecord(0), it computes size = 150 - 200, which underflows to approximately 0xFFFFFFFFFFFFFFCE as an unsigned 64-bit integer.
4. Deliver the file to the target: Send the crafted crash.mobi to the victim via email, file share, or any other delivery mechanism and social-engineer them into opening it with SumatraPDF.
5. Crash the application: SumatraPDF's DecodeExthHeader attempts to read ~256MB of data using the bogus size value, immediately accessing unmapped heap memory and crashing the process (GitHub Advisory).

• File System: Presence of a .mobi file with exactly 2 PDB records where record offsets are inverted (record 1 offset < record 0 offset); file may be named crash.mobi or similar.
• Process: SumatraPDF process (SumatraPDF.exe) terminating unexpectedly or generating a Windows Error Reporting (WER) crash dump shortly after opening a .mobi file.
• Logs: Windows Event Log entries (Event ID 1000 or 1001) indicating an application crash for SumatraPDF.exe; WER crash dumps in %LOCALAPPDATA%\CrashDumps\ or %TEMP% referencing SumatraPDF.exe.
• Network: Unusual delivery of .mobi files via email attachments or web downloads to endpoints with SumatraPDF installed, particularly from unknown or untrusted sources.

The GitHub security advisory indicates a patch is available, with the fix correcting the validation loop to start from index 0 (for (size_t i = 0; i < nRecs - 1; i++)) and adding a hard return in GetRecord when off > nextOff instead of only logging. Users should update SumatraPDF to the latest version available from the official repository. As a workaround, restrict users from opening untrusted .mobi files, and consider disabling Mobi file support in environments where it is not required. Educating users to avoid opening files from unknown sources is also recommended (GitHub Advisory).

The vulnerability was reported by researcher ub1cu0 and acknowledged by SumatraPDF maintainer kjk via the GitHub security advisory system. Red Hat has tracked the CVE in their security database. No significant broader media coverage or notable community discussion has been identified beyond standard vulnerability aggregator entries (GitHub Advisory, Red Hat CVE).