{"id":"CVE-2026-25920","summary":"SumatraPDF has a heap out-of-bounds read in MOBI HuffDic decompressor","details":"SumatraPDF is a multi-format reader for Windows. In 3.5.2 and earlier, a heap out-of-bounds read vulnerability exists in SumatraPDF's MOBI HuffDic decompressor. The bounds check in AddCdicData() only validates half the range that DecodeOne() actually accesses. Opening a crafted .mobi file can read nearly (1 \u003c\u003c codeLength) bytes beyond the CDIC dictionary buffer, leading to a crash.","aliases":["GHSA-5mwx-65x7-cffp"],"modified":"2026-08-12T15:31:58.664653Z","published":"2026-02-09T21:32:26.520Z","database_specific":{"cna_assigner":"GitHub_M","cwe_ids":["CWE-125"],"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/25xxx/CVE-2026-25920.json"},"references":[{"type":"WEB","url":"https://github.com/sumatrapdfreader/sumatrapdf/blob/916392f94bc34e24f3c3286893ac6d7fa1e1c428/src/MobiDoc.cpp"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/25xxx/CVE-2026-25920.json"},{"type":"ADVISORY","url":"https://github.com/sumatrapdfreader/sumatrapdf/security/advisories/GHSA-5mwx-65x7-cffp"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-25920"},{"type":"FIX","url":"https://github.com/sumatrapdfreader/sumatrapdf/commit/12b6887e9dfff874fe8749bab1bdc53d4ff075b3"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/sumatrapdfreader/sumatrapdf","events":[{"introduced":"0"},{"fixed":"12b6887e9dfff874fe8749bab1bdc53d4ff075b3"}],"database_specific":{"cpe":"cpe:2.3:a:sumatrapdfreader:sumatrapdf:*:*:*:*:*:*:*:*","extracted_events":[{"introduced":"0"},{"last_affected":"3.5.2"}],"source":["CPE_RANGE","REFERENCES"]}}],"versions":["3.2","3.1.2rel","3.0split","2.5split","2.4split","2.3split","2.2split","2.1split","2.0split","1.9split","1.8split","1.7split","1.6split","1.5split","1.4split"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-25920.json","vanir_signatures_modified":"2026-08-12T15:31:58Z","vanir_signatures":[{"deprecated":false,"digest":{"function_hash":"117232748217294490266174539146530574947","length":838},"id":"CVE-2026-25920-9a701750","signature_type":"Function","signature_version":"v1","source":"https://github.com/sumatrapdfreader/sumatrapdf/commit/12b6887e9dfff874fe8749bab1bdc53d4ff075b3","target":{"file":"src/MobiDoc.cpp","function":"HuffDicDecompressor::SetHuffData"}},{"target":{"file":"src/MobiDoc.cpp","function":"HuffDicDecompressor::AddCdicData"},"deprecated":false,"digest":{"function_hash":"287350018242290791815942785293087108917","length":736},"id":"CVE-2026-25920-e3fc5624","signature_type":"Function","signature_version":"v1","source":"https://github.com/sumatrapdfreader/sumatrapdf/commit/12b6887e9dfff874fe8749bab1bdc53d4ff075b3"},{"id":"CVE-2026-25920-e5bbf2fb","signature_type":"Line","signature_version":"v1","source":"https://github.com/sumatrapdfreader/sumatrapdf/commit/12b6887e9dfff874fe8749bab1bdc53d4ff075b3","target":{"file":"src/MobiDoc.cpp"},"deprecated":false,"digest":{"line_hashes":["298600831982538125963483751285307927202","60359313055809950785221283734856490973","130352140609533347702064622006691316427","243357575680573494118927259087660144105","10603795066347093376650904837710558042","47245944678176726615706817976194915650","110682252844980296563670685921481200219","317370050401019544382990563854595922129"],"threshold":0.9}}]}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H"}]}