Vulnerabilities

TI-2026-20986 CVE-2026-25961

SumatraPDF Update MITM -> Arbitrary Code Execution

LOW 35

SumatraPDF is a multi-format reader for Windows.

CVSS 3.1HIGH 7.5 Network No auth User interaction EPSS 0.00449 Published 2026-02-09 No fix listed CWE-295

TI-2026-20950 CVE-2026-25920

SumatraPDF has a heap out-of-bounds read in MOBI HuffDic decompressor

LOW 24

SumatraPDF is a multi-format reader for Windows.

CVSS 3.1MEDIUM 5.5 Local No auth User interaction EPSS 0.00265 Published 2026-02-09 No fix listed CWE-125

TI-2026-20920 CVE-2026-25880

Untrusted Search Path in SumatraPDF Reader (explorer.exe on Windows)

LOW 35

SumatraPDF is a multi-format reader for Windows.

CVSS 3.1HIGH 7.8 Local No auth User interaction EPSS 0.00229 Published 2026-02-09 No fix listed CWE-426

TI-2026-19293 CVE-2026-23951

SumatraPDF's Integer Underflow in PalmDbReader Leads to Crash

MEDIUM 58

SumatraPDF is a multi-format reader for Windows.

CVSS 3.1MEDIUM 5.5 Local No auth User interaction EPSS 0.00221 Published 2026-01-22 No fix listed CWE-125

TI-2026-18936 CVE-2026-23512

SumatraPDF has an Untrusted Search Path in sumatrapdf/src/AppTools.cpp

HIGH 72

SumatraPDF is a multi-format reader for Windows.

CVSS 3.1HIGH 8.6 Local No auth User interaction EPSS 0.00227 Published 2026-01-14 No fix listed CWE-426

TI-2025-35489 CVE-2025-57248 · GHSA-5gwg-fch7-wh55

A null pointer dereference vulnerability was discovered in SumatraPDF 3.5.2 during the…

HIGH 71

A null pointer dereference vulnerability was discovered in SumatraPDF 3.5.2 during the processing of a crafted .djvu file.

CVSS 3.1HIGH 7.3 Network No auth No interaction EPSS 0.00244 Published 2025-09-15 No fix listed CWE-476

TI-2023-16705 CVE-2023-33802 · GHSA-mhq9-63xw-5x49

A buffer overflow in SumatraPDF Reader v3.4.6 allows attackers to cause a Denial of…

MEDIUM 58

A buffer overflow in SumatraPDF Reader v3.4.6 allows attackers to cause a Denial of Service (DoS) via a crafted text file.

CVSS 3.1MEDIUM 5.5 Local No auth User interaction EPSS 0.00312 Published 2023-07-26 No fix listed CWE-120

TI-2012-04514 CVE-2012-5340 · GHSA-g8x3-qg8h-3qqr

SumatraPDF 2.1.1/MuPDF 1.0 allows remote attackers to cause an Integer Overflow in the…

HIGH 69

SumatraPDF 2.1.1/MuPDF 1.0 allows remote attackers to cause an Integer Overflow in the lex_number() function via a corrupt PDF file.

CVSS 3.1HIGH 7.8 Local No auth User interaction EPSS 0.05731 Published 2020-01-23 No fix listed CWE-190

TI-2013-02473 CVE-2013-2830 · GHSA-pxq3-h2cm-cxrj

Use-after-free vulnerability in SumatraPDF Reader 2.x before 2.2.1 allows remote…

MEDIUM 40

Use-after-free vulnerability in SumatraPDF Reader 2.x before 2.2.1 allows remote attackers to execute arbitrary code via a crafted PDF file.

CVSS 3.1HIGH 7.8 Local No auth User interaction EPSS 0.03629 Published 2018-02-08 No fix listed CWE-416

TI-2012-04138 CVE-2012-4896 · GHSA-q9xm-6wgc-cfhr

Heap-based buffer overflow in SumatraPDF before 2.1 allows remote attackers to execute…

MEDIUM 48

Heap-based buffer overflow in SumatraPDF before 2.1 allows remote attackers to execute arbitrary code via a crafted PDF document, a different vulnerability than CVE-2012-4895.

CVSS 2.0HIGH 9.3 Network No auth Interaction — EPSS 0.05193 Published 2012-10-05 No fix listed CWE-119

TI-2012-04137 CVE-2012-4895 · GHSA-678j-gm52-3vq4

Heap-based buffer overflow in SumatraPDF before 2.1 allows remote attackers to execute…

MEDIUM 48

Heap-based buffer overflow in SumatraPDF before 2.1 allows remote attackers to execute arbitrary code via a crafted PDF document, a different vulnerability than CVE-2012-4896.

CVSS 2.0HIGH 9.3 Network No auth Interaction — EPSS 0.05193 Published 2012-10-05 No fix listed CWE-119

TI-2009-03906 CVE-2009-4117 · GHSA-5m5r-69xr-2fx8

Multiple stack-based buffer overflows in pdf_shade4.c in MuPDF before commit…

MEDIUM 51

Multiple stack-based buffer overflows in pdf_shade4.c in MuPDF before commit 20091125231942, as used in SumatraPDF before 1.0.1, allow remote attackers to cause a denial of service and possibly execute arbitrary code via…

CVSS 2.0HIGH 9.3 Network No auth Interaction — EPSS 0.07776 Published 2009-12-01 No fix listed CWE-119

TI-2009-01521 CVE-2009-1605 · GHSA-g6xf-xq8f-56f4

Heap-based buffer overflow in the loadexponentialfunc function in mupdf/pdf_function.c in…

MEDIUM 58

Heap-based buffer overflow in the loadexponentialfunc function in mupdf/pdf_function.c in MuPDF in the mupdf-20090223-win32 package, as used in SumatraPDF 0.9.3 and earlier, allows remote attackers to execute arbitrary c…

CVSS 3.1MEDIUM 5.4 Network No auth User interaction EPSS 0.03446 Published 2009-05-11 No fix listed CWE-119

Vulnerabilities

Filters