TI-2026-18936 Aliases CVE-2026-23512

SumatraPDF has an Untrusted Search Path in sumatrapdf/src/AppTools.cpp

HIGH 72CWE-426Published 2026-01-14 · Updated 2026-01-14

Key facts

Attack vector: Local
Privileges required: None
User interaction: Required
Attack complexity: Low
Impact type: Code execution
Confidentiality · integrity · availability: High · High · High
Fix status: No fix listed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-426.

Summary

SumatraPDF is a multi-format reader for Windows. In 3.5.2 and earlier, there is a Untrusted Search Path vulnerability when Advanced Options setting is trigger. The application executes notepad.exe without specifying an absolute path when using the Advanced Options setting. On Windows, this allows execution of a malicious notepad.exe placed in the application's installation directory, leading to arbitrary code execution.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV

EPSS 0.00227 13th percentileScored 2026-11-07

Public exploit Yes 1 exploit referenceTagged by NVD

Fix No fix listed No fixed version in the sources yet

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: Poc
Automatable: No
Technical impact: Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
sumatrapdfreader	sumatrapdf	up to 3.5.2	—	No fix listed	CNA

sumatrapdf Vendorsumatrapdfreader Affected up to 3.5.2 Fixed in — No fix listed CNA

CPE configurations NVD · 2

CPE	Versions	Role	Vendor
cpe:2.3:a:sumatrapdfreader:sumatrapdf::::::::	up to 3.5.2	Vulnerable	sumatrapdfreader
cpe:2.3:o:microsoft:windows:-:::::::*	not specified by NVD	Running on	Microsoft

cpe:2.3:a:sumatrapdfreader:sumatrapdf:*:*:*:*:*:*:*:* Versions up to 3.5.2 Vulnerable ·sumatrapdfreader
cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Microsoft

Remediation

No fixed version listed by the sources yet.

Timeline

2026-10-02 Threatist record created from CVE-2026-23512

References

Exploit 1

https://github.com/sumatrapdfreader/sumatrapdf/security/advisories/GHSA-rqg5-gj63-x4mv

Patch 1

https://github.com/sumatrapdfreader/sumatrapdf/commit/2762e02a8cd7cb779c934a44257aac56ab7de673

TI-2025-35489 A null pointer dereference vulnerability was discovered in SumatraPDF 3.5.2 during the… CVSS 3.1HIGH 7.3
TI-2012-04514 SumatraPDF 2.1.1/MuPDF 1.0 allows remote attackers to cause an Integer Overflow in the… CVSS 3.1HIGH 7.8
TI-2026-19293 SumatraPDF's Integer Underflow in PalmDbReader Leads to Crash CVSS 3.1MEDIUM 5.5
TI-2023-16705 A buffer overflow in SumatraPDF Reader v3.4.6 allows attackers to cause a Denial of… CVSS 3.1MEDIUM 5.5
TI-2009-01521 Heap-based buffer overflow in the loadexponentialfunc function in mupdf/pdf_function.c in… CVSS 3.1MEDIUM 5.4
TI-2009-03906 Multiple stack-based buffer overflows in pdf_shade4.c in MuPDF before commit… CVSS 2.0HIGH 9.3

See all 12 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences