| CVE-2026-25961 |
BDSA-2026-2696 |
High |
Feb 09, 2026 |
SumatraPDF is a multi-format reader for Windows. In 3.5.0 through 3.5.2, SumatraPDF's update mechanism disables TLS hostname verification (INTERNET_FLA
more...
SumatraPDF is a multi-format reader for Windows. In 3.5.0 through 3.5.2, SumatraPDF's update mechanism disables TLS hostname verification (INTERNET_FLAG_IGNORE_CERT_CN_INVALID) and executes installers without signature checks. A network attacker with any valid TLS certificate (e.g., Let's Encrypt) can intercept the update check request, inject a malicious installer URL, and achieve arbitrary code execution.
less...
|
3.5.2, 3.5.1, 3.5
|
| CVE-2026-25920 |
BDSA-2026-2695 |
Medium |
Feb 09, 2026 |
SumatraPDF is a multi-format reader for Windows. In 3.5.2 and earlier, a heap out-of-bounds read vulnerability exists in SumatraPDF's MOBI HuffDic deco
more...
SumatraPDF is a multi-format reader for Windows. In 3.5.2 and earlier, a heap out-of-bounds read vulnerability exists in SumatraPDF's MOBI HuffDic decompressor. The bounds check in AddCdicData() only validates half the range that DecodeOne() actually accesses. Opening a crafted .mobi file can read nearly (1 << codeLength) bytes beyond the CDIC dictionary buffer, leading to a crash.
less...
|
3.5.2, 3.5.1, 3.5, 3.4.6, 3.4.5, 3.4.4, 3.4.3, 3.3.3, 3.3.2, 3.3.1
|
| CVE-2026-25880 |
BDSA-2026-1812 |
High |
Feb 09, 2026 |
SumatraPDF is a multi-format reader for Windows. In 3.5.2 and earlier, the PDF reader allows execution of a malicious binary (explorer.exe) located in
more...
SumatraPDF is a multi-format reader for Windows. In 3.5.2 and earlier, the PDF reader allows execution of a malicious binary (explorer.exe) located in the same directory as the opened PDF when the user clicks File → “Show in folder”. This behavior leads to arbitrary code execution on the victim’s system with the privileges of the current user, without any warning or user interaction beyond the menu click.
less...
|
3.5.2, 3.5.1, 3.5, 3.4.6, 3.4.5, 3.4.4, 3.4.3, 3.3.3, 3.3.2, 3.3.1
|
| CVE-2026-23512 |
|
High |
Jan 14, 2026 |
SumatraPDF is a multi-format reader for Windows. In 3.5.2 and earlier, there is a Untrusted Search Path vulnerability when Advanced Options setting is
more...
SumatraPDF is a multi-format reader for Windows. In 3.5.2 and earlier, there is a Untrusted Search Path vulnerability when Advanced Options setting is trigger. The application executes notepad.exe without specifying an absolute path when using the Advanced Options setting. On Windows, this allows execution of a malicious notepad.exe placed in the application's installation directory, leading to arbitrary code execution.
less...
|
3.5.2, 3.5.1, 3.5, 3.4.6, 3.4.5, 3.4.4, 3.4.3, 3.3.3, 3.3.2, 3.3.1
|
| CVE-2025-57248 |
BDSA-2025-77553 |
High |
Sep 15, 2025 |
A null pointer dereference vulnerability was discovered in SumatraPDF 3.5.2 during the processing of a crafted .djvu file. When the file is opened, the
more...
A null pointer dereference vulnerability was discovered in SumatraPDF 3.5.2 during the processing of a crafted .djvu file. When the file is opened, the application crashes inside libmupdf.dll, specifically in the DataPool::has_data() function.
less...
|
3.5.2
|
| BDSA-2026-0905 |
|
Medium |
Jan 22, 2026 |
SumatraPDF is vulnerable to out-of-bounds reads due to an integer underflow in the `PalmDbReader.cpp` file, which is caused by an off-by-one error in t
more...
SumatraPDF is vulnerable to out-of-bounds reads due to an integer underflow in the `PalmDbReader.cpp` file, which is caused by an off-by-one error in the validation loop of the `ParseHeader` function. A local attacker could exploit this issue by using a maliciously crafted Mobi file in order to create a denial-of-service (DoS) condition.
less...
|
|
