Vulnerability · Published Feb 9, 2026 · Assigned by GitHub_M
CVE-2026-25961SumatraPDF Update MITM -> Arbitrary Code Execution
High 7.5
In plain English
A high-severity improper certificate validation in sumatrapdf from sumatrapdfreader. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 39% of all known vulnerabilities). Ready-made attack tooling exists: public proof-of-concept code.
Official description
SumatraPDF is a multi-format reader for Windows. In 3.5.0 through 3.5.2, SumatraPDF's update mechanism disables TLS hostname verification (INTERNET_FLAG_IGNORE_CERT_CN_INVALID) and executes installers without signature checks. A network attacker with any valid TLS certificate (e.g., Let's Encrypt) can intercept the update check request, inject a malicious installer URL, and achieve arbitrary code execution.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| sumatrapdfreader | sumatrapdf | >= 3.5.0, <= 3.5.2 |
Weakness: CWE-295, CWE-494 · Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H