CVE-2026-25920: 
SumatraPDF vulnerability analysis and mitigation

CVE-2026-25920 is a heap out-of-bounds read vulnerability in SumatraPDF's MOBI HuffDic decompressor, affecting all versions up to and including 3.5.2. The flaw was published on February 9, 2026, with the official GitHub Security Advisory (GHSA-5mwx-65x7-cffp) released the same day by the project maintainer. It carries a CVSS v3.1 base score of 5.5 (Medium), reflecting a local attack vector requiring user interaction (GitHub Advisory, Red Hat CVE).

The root cause is an off-by-factor-of-two bounds check error (CWE-125: Out-of-bounds Read) in src/MobiDoc.cpp. In AddCdicData() (line 390), the maximum valid dictionary size is validated against 1 << codeLength, but DecodeOne() (line 226) accesses the CDIC dictionary buffer at code * 2, where code can be up to (1 << codeLength) - 1 — meaning the actual maximum byte offset accessed is 2 * (1 << codeLength) - 2, exactly double what the check permits. A crafted .mobi file with HUFF compression, a specific codeLength value, and an undersized CDIC dictionary can trigger DecodeOne() to read nearly (1 << codeLength) bytes beyond the allocated buffer. The fix, committed by the maintainer, changes the bounds check to 2u * (1u << codeLength) (GitHub Advisory, Fix Commit).

Successful exploitation causes SumatraPDF to crash with an access violation in DecodeOne(), resulting in a denial of service (application crash). The impact is limited to availability — there is no confidentiality or integrity impact, as the vulnerability only enables a heap out-of-bounds read that terminates the process rather than leaking data or enabling code execution. The attack is confined to the local system and requires the victim to open a maliciously crafted .mobi file (GitHub Advisory).

A proof-of-concept (poc.mobi) is publicly available as part of the GitHub Security Advisory, demonstrating a crash with codeLength=8 and a 257-byte CDIC dictionary that causes DecodeOne() to read at offset 510 from the buffer. The EPSS score is 0.012% (very low), and there is no evidence of in-the-wild exploitation or CISA KEV catalog inclusion as of the advisory date. No threat actor attribution has been reported (GitHub Advisory).

1. Craft a malicious MOBI file: Create a .mobi file with HUFF compression enabled, set codeLength=8 in the CDIC header, and size the CDIC dictionary to only 257 bytes (just over 1 << codeLength = 256, which passes the flawed bounds check).
2. Configure the HUFF table: Set up the HUFF cache table so that the first input byte decodes to code=255, which will cause DecodeOne() to compute an access offset of 255 * 2 = 510 — well beyond the 257-byte dictionary buffer.
3. Deliver the file to the target: Send the crafted .mobi file to the victim via email, file share, or download link, relying on social engineering to prompt them to open it in SumatraPDF.
4. Trigger the crash: When the victim opens the file in SumatraPDF ≤ 3.5.2, the MOBI HuffDic decompressor processes the HUFF-compressed record, DecodeOne() reads at offset 510 from the 257-byte buffer, and the application crashes with an access violation (c0000005) at UInt16BE(dicts[0] + 510).
5. (Optional) Enable page-heap for reliable reproduction: Use gflags /p /enable SumatraPDF.exe /full to enable full page-heap, making the out-of-bounds access immediately fatal for testing purposes (GitHub Advisory).

• File System: Presence of unexpected or unsolicited .mobi files in user download directories or email attachments; the PoC file is named poc.mobi and is distributed as poc.zip.
• Process/Crash: SumatraPDF process terminating with an access violation (c0000005) crash; Windows Error Reporting (WER) crash dumps referencing SumatraPDF+0xbd234 or the DecodeOne() function in MobiDoc.cpp.
• Logs: Windows Application Event Log entries showing SumatraPDF application faults with faulting module SumatraPDF.exe; crash dump files (.dmp) generated in %LOCALAPPDATA%\CrashDumps or %TEMP% associated with SumatraPDF (GitHub Advisory).

The vulnerability is fixed in SumatraPDF versions newer than 3.5.2; users should update to the latest available release from the official SumatraPDF website. The specific code fix changes the bounds check in AddCdicData() from 1 << codeLength to 2u * (1u << codeLength), as applied in commit 12b6887 (Fix Commit). As a workaround for users unable to update immediately, avoid opening .mobi files from untrusted or unknown sources (GitHub Advisory).

The vulnerability was reported by researcher haaeein and acknowledged by SumatraPDF maintainer kjk, who published the advisory and committed the fix on February 9–10, 2026. Red Hat also tracked the CVE in their security database. No significant broader media coverage or notable community discussion beyond the advisory itself has been identified (GitHub Advisory, Red Hat CVE).