Sumatrapdf
CVE-2026-25961
HIGH
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessPosition network on update path
-
ExploitIntercept update check request
-
ExecutionInject malicious installer URL
-
ImpactExecute unsigned installer code
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A07:2025 - Authentication Failures
ASVS 5.0
V12 - Secure Communication Certificate validation
|
| Exploitation Conditions | SumatraPDF versions 3.5.0–3.5.2 with active update mechanism enabled. Attacker requires valid TLS certificate (obtainable via Let's Encrypt) and network position to intercept update traffic. User must trigger update check. |
| Impact | CVSS 7.5 (HIGH). Attack vector: Network. Complexity: High. Privileges required: None. User interaction: Required. Exploitable via remote/network. Public exploit/POC available. |
| Exploit ScenarioDerived | A remote attacker could exploit this vulnerability to compromise the affected system. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Mar 12, 2026
SumatraPDF versions 3.5.0 through 3.5.2 fail to validate TLS certificates during software updates and execute installers without signature verification, allowing network attackers to perform man-in-the-middle attacks and inject malicious code. An attacker with any valid TLS certificate can intercept update requests and redirect users to a malicious installer, achieving arbitrary code execution on Windows systems. Public exploit code exists for this vulnerability and no patch is currently available.
Earlier versions of this analysis (1)
SumatraPDF is a multi-format reader for Windows. In 3.5.0 through 3.5.2, SumatraPDF's update mechanism disables TLS hostname verification (INTERNET_FLAG_IGNORE_CERT_CN_INVALID) and executes installers without signature checks. [CVSS 7.5 HIGH]
RemediationAI
Monitor vendor advisories for a patch. Restrict network access to the affected service where possible.
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Classified as CWE-295 (Improper Certificate Validation). Affects Sumatrapdf. SumatraPDF is a multi-format reader for Windows. In 3.5.0 through 3.5.2, SumatraPDF's update mechanism disables TLS hostname verification (INTERNET_FLAG_IGNORE_CERT_CN_INVALID) and executes installers without signature checks. A network attacker with any valid TLS certificate (e.g., Let's Encrypt) can intercept the update check request, inject a malicious installer URL, and achieve arbitrary code execution.
Know when Sumatrapdf gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
Primary rating from GitHub Advisory · only source for this CVE.
CVSS VectorGitHub Advisory
Lifecycle Timeline
2DescriptionGitHub Advisory
SumatraPDF is a multi-format reader for Windows. In 3.5.0 through 3.5.2, SumatraPDF's update mechanism disables TLS hostname verification (INTERNET_FLAG_IGNORE_CERT_CN_INVALID) and executes installers without signature checks. A network attacker with any valid TLS certificate (e.g., Let's Encrypt) can intercept the update check request, inject a malicious installer URL, and achieve arbitrary code execution.
Executive ViewAI
SumatraPDF versions 3.5.0-3.5.2 contain a critical flaw in their update mechanism that disables security verification, allowing attackers to inject malicious code during software updates without detection. Any organization using affected versions is at immediate risk of compromise through supply chain attack vectors, potentially affecting endpoints across the enterprise.
- Disable SumatraPDF auto-update feature on all affected systems via configuration files or group policy; 2) Block update server domains (sumatrapdf.org update endpoints) at firewall/proxy to prevent vulnerable update checks; 3) Implement application whitelisting to prevent unsigned executable execution; 4) Monitor for suspicious update-related network connections and process execution; 5) Isolate affected systems from sensitive networks if business-critical; 6) Require manual user approval before any application updates; 7) Monitor endpoint detection and response (EDR) tools for suspicious SumatraPDF behavior or child process spawning.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Exploit-DB
GitHub
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Affected Products (CPE)GitHub Advisory
More in Sumatrapdf
View allSumatraPDF 3.5.2 and earlier on Windows contains an untrusted search path vulnerability in the Advanced Options feature
SumatraPDF 3.5.2 and earlier on Windows allows arbitrary code execution when a user opens a PDF and selects "Show in fol
Heap-based buffer overflow in SumatraPDF before 2.1 allows remote attackers to execute arbitrary code via a crafted PDF
Heap-based buffer overflow in SumatraPDF before 2.1 allows remote attackers to execute arbitrary code via a crafted PDF
SumatraPDF versions 3.5.2 and earlier are vulnerable to a heap buffer over-read in the MOBI file parser due to incomplet
SumatraPDF on Windows is vulnerable to a denial-of-service attack through a maliciously crafted Mobi file that triggers
A buffer overflow in SumatraPDF Reader v3.4.6 allows attackers to cause a Denial of Service (DoS) via a crafted text fil
Local code execution in SumatraPDF 3.6.1 and earlier on Windows is possible when a user opens an attacker-supplied docum
Parsing a malformed PDF in SumatraPDF 3.6.1 can crash the reader through a signed integer overflow in the PageLabels han
Command-line argument injection in SumatraPDF 3.5.2 and earlier lets an attacker-controlled SyncTeX source filename esca
Argument injection in the AI translation feature of SumatraPDF 3.6.1 and earlier allows text placed in a document select
Opening a crafted MOBI e-book in SumatraPDF versions before 3.6 can crash the application because the MOBI header decode