CVE-2026-115758 Details
Description
SumatraPDF is a multi-format reader for Windows. In version 3.6.1 and earlier, HttpGet() in src/base/Http_win.cpp unconditionally passes INTERNET_FLAG_IGNORE_CERT_CN_INVALID to WinINet, disabling hostname matching for HTTPS update metadata and crash-symbol requests while retaining certificate-chain validation. A network-positioned attacker with a Windows-trusted certificate for an attacker-controlled domain can impersonate the project's update host, inject promo text and a clickable URL before update metadata validation, and provide an attacker-controlled archive to ExtractSymbols(). Installer replacement is not directly possible because HttpGetToFile() validates TLS and MaybeStartUpdateDownload() restricts the download host. No fixed version is available as of this review.
A vulnerability in SumatraPDF's update mechanism for Windows has been identified, affecting versions through 3.6.1. The issue arises because the 'HttpGet()' function in 'src/base/Http_win.cpp' improperly handles HTTPS certificate validation. It unconditionally includes the 'INTERNET_FLAG_IGNORE_CERT_CN_INVALID' flag, which disables crucial hostname verification. This flaw allows a network attacker with a trusted certificate from an attacker-controlled domain to impersonate the update server, inject malicious promotional content and URLs, and deliver a tampered archive to the symbol extraction process. While the vulnerability disrupts TLS hostname validation, the update installer remains protected by separate validation and host restrictions.
Users can manually update SumatraPDF by visiting the official download page. However, as of this review, no patched version is available.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Nov 4, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/sumatrapdfreader/sumatrapdf/commit/bd30134175e897dd5ed0d7fd14acce52eeca7183 | [email protected] | Source CodeVendor |
| https://github.com/sumatrapdfreader/sumatrapdf/security/advisories/GHSA-mjwr-9w29-jp96 | [email protected] | AdvisoryRemedyVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-297 | Improper Validation of Certificate with Host Mismatch | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| SumatraPDF | <= 3.6.1 (semver) |
CPE
Remediation
| |
Change History
1 change record found show changes
| Date | Action | Recorded By |
|---|---|---|
| Nov 4, 2026 | New CVE Received | [email protected] |