CVE-2026-23951

MediumCVSS 5.5/10Last modified Jun 17, 2026

Description

SumatraPDF is a multi-format reader for Windows. All versions contain an off-by-one error in the validation code that only triggers with exactly 2 records, causing an integer underflow in the size calculation. This bug exists in PalmDbReader::GetRecord when opening a crafted Mobi file, resulting in an out-of-bounds heap read that crashes the app. There are no published fixes at the time of publication.

Metrics

CVSS 3.1 5.5/10CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

Weakness enumeration

CWE-125 CWE-191 CWE-193

Affected software

No affected versions have been published.

Timeline

Published: Jan 22, 2026
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2026

CVE-2026-239527.5ImageMagick is free and open-source software used for editing and manipulating digital images. Versions 14.10.1 and below have a NULL pointe CVE-2026-239538.7Incus is a system container and virtual machine manager. In versions 6.20.0 and below, a user with the ability to launch a container with a CVE-2026-239548.7Incus is a system container and virtual machine manager. Versions 6.21.0 and below allow a user with the ability to launch a container with CVE-2026-239554.2EVerest is an EV charging software stack. Prior to version 2025.9.0, in several places, integer values are concatenated to literal strings w CVE-2026-239567.5seroval facilitates JS value stringification, including complex structures beyond JSON.stringify capabilities. In versions 0.2.0 through 1.4 CVE-2026-239577.5seroval facilitates JS value stringification, including complex structures beyond JSON.stringify capabilities. In versions 1.4.0 and below, CVE-2026-239589.8Dataease is an open source data visualization analysis tool. Prior to version 2.10.19, DataEase uses the MD5 hash of the user’s password as CVE-2026-239594.9CoreShop is a Pimcore enhanced eCommerce solution. An error-based SQL Injection vulnerability was identified in versions prior to 4.1.9 in t CVE-2026-23964.4The List View Google Calendar plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the event description in all versions up CVE-2026-239605.4Argo Workflows is an open source container-native workflow engine for orchestrating parallel jobs on Kubernetes. Prior to versions 3.6.17 an CVE-2026-239615.3Mastodon is a free, open-source social network server based on ActivityPub. Mastodon allows server administrators to suspend remote users to CVE-2026-239627.5Mastodon is a free, open-source social network server based on ActivityPub. Mastodon versions before v4.3.18, v4.4.12, and v4.5.5 do not hav