Read the docs
TI-2026-85197 Aliases CVE-2026-115758

Missing TLS hostname validation in SumatraPDF HTTP requests

Priority LOW 35CWE-297Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
High
Attack requirements
Present
Impact type
—
Confidentiality · integrity · availability
None · High · None
Fix status
No fix listed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA.

Summary

SumatraPDF through 3.6.1 disables TLS hostname matching for HTTPS update and crash-symbol requests (CWE-297). A network-positioned attacker with a Windows-trusted certificate for their own domain can impersonate the update host, inject promo text and a clickable URL, and supply an archive for symbol extraction.

Written with Claude Haiku 5.5 from the sources below · 2026-11-04

Description from the CNA

SumatraPDF is a multi-format reader for Windows. In version 3.6.1 and earlier, HttpGet() in src/base/Http_win.cpp unconditionally passes INTERNET_FLAG_IGNORE_CERT_CN_INVALID to WinINet, disabling hostname matching for HTTPS update metadata and crash-symbol requests while retaining certificate-chain validation. A network-positioned attacker with a Windows-trusted certificate for an attacker-controlled domain can impersonate the project's update host, inject promo text and a clickable URL before update metadata validation, and provide an attacker-controlled archive to ExtractSymbols(). Installer replacement is not directly possible because HttpGetToFile() validates TLS and MaybeStartUpdateDownload() restricts the download host. No fixed version is available as of this review.

Why it matters now

EPSS 0.00145 3rd percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
sumatrapdfreadersumatrapdfup to 3.6.1—No fix listedCNA
  • sumatrapdf Vendorsumatrapdfreader Affected up to 3.6.1 Fixed in — No fix listed CNA

CPE names Threatist (inferred) · 1

Inferred from how NVD named this product before; not given by a source.

CPEVersionsRoleVendor
cpe:2.3:a:sumatrapdfreader:sumatrapdf:*:*:*:*:*:*:*:*——sumatrapdfreader
  • cpe:2.3:a:sumatrapdfreader:sumatrapdf:*:*:*:*:*:*:*:* Versions — — ·sumatrapdfreader

Remediation

The sources list no fixed version for SumatraPDF.

Written with Claude Haiku 5.5 from the sources below · 2026-11-04

Timeline

  1. 2026-11-04 Threatist record created from CVE-2026-115758
  2. 2026-11-06 Priority changed: MEDIUM → LOW

References

Other 2

  • TI-2026-18936 SumatraPDF has an Untrusted Search Path in sumatrapdf/src/AppTools.cpp CVSS 3.1HIGH 8.6
  • TI-2025-35489 A null pointer dereference vulnerability was discovered in SumatraPDF 3.5.2 during the… CVSS 3.1HIGH 7.3
  • TI-2012-04514 SumatraPDF 2.1.1/MuPDF 1.0 allows remote attackers to cause an Integer Overflow in the… CVSS 3.1HIGH 7.8
  • TI-2026-69819 Argument injection in SumatraPDF selection translation on Windows CVSS 4.0HIGH 7.1
  • TI-2026-69814 SumatraPDF: SyncTeX Argument Injection in Inverse Search Enables Arbitrary Command Execution via External Editors CVSS 4.0HIGH 7.1
  • TI-2026-69813 Null pointer dereference in SumatraPDF CmdExec crashes the reader CVSS 4.0MEDIUM 6.8
See all 26 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences