CVE-2026-115758

Deferred Deferred - Pending Action

SumatraPDF HTTPS Certificate Validation Bypass via WinINet

Publication date: 2026-11-04

Last updated on: 2026-11-04

Assigner: GitHub, Inc.

Description

SumatraPDF is a multi-format reader for Windows. In version 3.6.1 and earlier, HttpGet() in src/base/Http_win.cpp unconditionally passes INTERNET_FLAG_IGNORE_CERT_CN_INVALID to WinINet, disabling hostname matching for HTTPS update metadata and crash-symbol requests while retaining certificate-chain validation. A network-positioned attacker with a Windows-trusted certificate for an attacker-controlled domain can impersonate the project's update host, inject promo text and a clickable URL before update metadata validation, and provide an attacker-controlled archive to ExtractSymbols(). Installer replacement is not directly possible because HttpGetToFile() validates TLS and MaybeStartUpdateDownload() restricts the download host. No fixed version is available as of this review.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-11-04

Last Modified

2026-11-04

Generated

2026-11-05

AI Q&A

2026-11-05

EPSS Evaluated

N/A

NVD

CVE-2026-115758

EUVD

EUVD-2026-117098

Affected Vendors & Products

Vendor	Product	Version / Range
sumatrapdfreader	sumatrapdf	<= 3.6.1

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-297	The product communicates with a host that provides a certificate, but the product does not properly ensure that the certificate is actually associated with that host.

Attack-Flow Graph

Executive Summary

SumatraPDF versions 3.6.1 and earlier have a vulnerability in the HttpGet() function in src/base/Http_win.cpp. It unconditionally passes INTERNET_FLAG_IGNORE_CERT_CN_INVALID to WinINet, disabling TLS hostname validation for HTTPS update metadata and crash-symbol requests. This allows network attackers with a trusted certificate for an attacker-controlled domain to impersonate the update host, inject malicious content, and provide attacker-controlled archives to ExtractSymbols().

The issue stems from an unnecessary workaround for cipher-suite incompatibility in older Windows versions. No fixed version is available as of this review.

Detection Guidance

This vulnerability cannot be directly detected via commands as it involves a flaw in SumatraPDF's TLS hostname validation. However, you can check if your SumatraPDF version is 3.6.1 or earlier by inspecting the application properties or checking the update logs for suspicious activity like unexpected promotional content or crash-symbol errors.

Impact Analysis

A network-positioned attacker could impersonate the legitimate SumatraPDF update host (www.sumatrapdfreader.org) and inject attacker-controlled promotional content into the application UI. They could also provide a malicious archive to the crash-symbol extractor, potentially leading to further compromise.

While the installer download is protected by separate validations, the update metadata and crash symbols are vulnerable. Affected users are those running SumatraPDF on networks susceptible to manipulation, with no additional authentication or configuration required.

Mitigation Strategies

Stop using SumatraPDF versions 3.6.1 or earlier on networks susceptible to manipulation (e.g., public Wi-Fi, untrusted networks).
Manually download updates only from the official website (www.sumatrapdfreader.org) and verify the download source.
Monitor network traffic for unexpected connections to SumatraPDF update or crash-symbol hosts.
Consider switching to an alternative PDF reader until a patched version is released.

Hi! I’m here to help you understand CVE-2026-115758. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70

EPSS Chart

Security Radar

News mentioning this vulnerability

Loading related security news...