CVE-2026-23951

SumatraPDF is affected by an off-by-one error in PalmDbReader::GetRecord when opening crafted Mobi files, triggering only with exactly 2 records and causing an integer underflow in the size calculation. This leads to an out-of-bounds heap read that crashes the application. The CVE notes indicate ...