Vulnerabilities

TI-2026-85197 CVE-2026-115758

Missing TLS hostname validation in SumatraPDF HTTP requests

LOW 35

SumatraPDF is a multi-format reader for Windows.

CVSS 4.0HIGH 8.2 Network No auth No interaction EPSS 0.00145 Published 2026-11-04 No fix listed CWE-297

TI-2026-69819 CVE-2026-107802

Argument injection in SumatraPDF selection translation on Windows

HIGH 66

SumatraPDF is a multi-format reader for Windows.

CVSS 4.0HIGH 7.1 Local No auth User interaction EPSS 0.00196 Published 2026-10-08 No fix listed CWE-88

TI-2026-69818 CVE-2026-107738

Out-of-bounds read in SumatraPDF CHM parser crashes the application

LOW 29

SumatraPDF is a multi-format reader for Windows.

CVSS 4.0MEDIUM 6.8 Local No auth User interaction EPSS 0.0012 Published 2026-10-08 No fix listed CWE-125

TI-2026-69817 CVE-2026-107737

Out-of-bounds object lookup in SumatraPDF CHM its:// handling

MEDIUM 59

SumatraPDF is a multi-format reader for Windows.

CVSS 4.0MEDIUM 5.7 Local No auth User interaction EPSS 0.00182 Published 2026-10-08 No fix listed CWE-129

TI-2026-69816 CVE-2026-107736

Stack buffer overflow in SumatraPDF EXIF Orientation handling

LOW 29

SumatraPDF is a multi-format reader for Windows.

CVSS 4.0MEDIUM 6.8 Local No auth User interaction EPSS 0.0012 Published 2026-10-08 No fix listed CWE-121

TI-2026-69815 CVE-2026-107735

SumatraPDF restriction INI file never revokes any permission

MEDIUM 60

SumatraPDF is a multi-format reader for Windows.

CVSS 4.0MEDIUM 5.4 Local Low privileges User interaction EPSS 0.00172 Published 2026-10-08 No fix listed CWE-636

TI-2026-69814 CVE-2026-107734

SumatraPDF: SyncTeX Argument Injection in Inverse Search Enables Arbitrary Command Execution via External Editors

HIGH 66

SumatraPDF is a multi-format reader for Windows.

CVSS 4.0HIGH 7.1 Local No auth User interaction EPSS 0.002 Published 2026-10-08 No fix listed CWE-20

TI-2026-69813 CVE-2026-107733

Null pointer dereference in SumatraPDF CmdExec crashes the reader

MEDIUM 63

SumatraPDF is a multi-format reader for Windows.

CVSS 4.0MEDIUM 6.8 Local Low privileges No interaction EPSS 0.00156 Published 2026-10-08 No fix listed CWE-476

TI-2026-69812 CVE-2026-107732

Markup injection in SumatraPDF notifications runs local programs

LOW 37

SumatraPDF is a multi-format reader for Windows.

CVSS 4.0HIGH 8.4 Local No auth User interaction EPSS 0.00131 Published 2026-10-08 No fix listed CWE-94

TI-2026-69811 CVE-2026-107731

SumatraPDF LIT parser range checks allow invalid pointer reads

LOW 24

SumatraPDF is a multi-format reader for Windows.

CVSS 3.1MEDIUM 5.5 Local No auth User interaction EPSS 0.00113 Published 2026-10-08 No fix listed CWE-125

TI-2026-69810 CVE-2026-107730

Integer overflow in SumatraPDF LIT header parsing crashes the app

LOW 24

SumatraPDF is a multi-format reader for Windows.

CVSS 3.1MEDIUM 5.5 Local No auth User interaction EPSS 0.00122 Published 2026-10-08 No fix listed CWE-190

TI-2026-69809 CVE-2026-107729

Out-of-bounds read in SumatraPDF MOBI parsing crashes the app

LOW 24

SumatraPDF is a multi-format reader for Windows.

CVSS 3.1MEDIUM 5.5 Local No auth User interaction EPSS 0.00146 Published 2026-10-08 No fix listed CWE-125

TI-2026-21058 CVE-2026-26054

SumatraPDF: Heap out-of-bounds read in MOBI header parser.

MEDIUM 63

SumatraPDF is a multi-format reader for Windows.

CVSS 4.0MEDIUM 6.8 Local No auth User interaction EPSS 0.00209 Published 2026-09-24 Fixed in 3.6 CWE-125

TI-2026-40125 CVE-2026-55586

SumatraPDF: Heap out-of-bounds write in vendored CHMLib LZX Huffman table construction reachable from crafted CHM files

LOW 28

SumatraPDF is a multi-format reader for Windows.

CVSS 3.1MEDIUM 6.6 Local No auth User interaction EPSS 0.00174 Published 2026-08-20 No fix listed CWE-119

TI-2026-20986 CVE-2026-25961

SumatraPDF Update MITM -> Arbitrary Code Execution

LOW 35

SumatraPDF is a multi-format reader for Windows.

CVSS 3.1HIGH 7.5 Network No auth User interaction EPSS 0.00449 Published 2026-02-09 No fix listed CWE-295

TI-2026-20950 CVE-2026-25920

SumatraPDF has a heap out-of-bounds read in MOBI HuffDic decompressor

LOW 24

SumatraPDF is a multi-format reader for Windows.

CVSS 3.1MEDIUM 5.5 Local No auth User interaction EPSS 0.00265 Published 2026-02-09 No fix listed CWE-125

TI-2026-20920 CVE-2026-25880

Untrusted Search Path in SumatraPDF Reader (explorer.exe on Windows)

LOW 35

SumatraPDF is a multi-format reader for Windows.

CVSS 3.1HIGH 7.8 Local No auth User interaction EPSS 0.00229 Published 2026-02-09 No fix listed CWE-426

TI-2026-19293 CVE-2026-23951

SumatraPDF's Integer Underflow in PalmDbReader Leads to Crash

MEDIUM 58

SumatraPDF is a multi-format reader for Windows.

CVSS 3.1MEDIUM 5.5 Local No auth User interaction EPSS 0.00221 Published 2026-01-22 No fix listed CWE-125

TI-2026-18936 CVE-2026-23512

SumatraPDF has an Untrusted Search Path in sumatrapdf/src/AppTools.cpp

HIGH 72

SumatraPDF is a multi-format reader for Windows.

CVSS 3.1HIGH 8.6 Local No auth User interaction EPSS 0.00227 Published 2026-01-14 No fix listed CWE-426

TI-2025-35489 CVE-2025-57248 · GHSA-5gwg-fch7-wh55

A null pointer dereference vulnerability was discovered in SumatraPDF 3.5.2 during the…

HIGH 71

A null pointer dereference vulnerability was discovered in SumatraPDF 3.5.2 during the processing of a crafted .djvu file.

CVSS 3.1HIGH 7.3 Network No auth No interaction EPSS 0.00244 Published 2025-09-15 No fix listed CWE-476

TI-2023-16705 CVE-2023-33802 · GHSA-mhq9-63xw-5x49

A buffer overflow in SumatraPDF Reader v3.4.6 allows attackers to cause a Denial of…

MEDIUM 58

A buffer overflow in SumatraPDF Reader v3.4.6 allows attackers to cause a Denial of Service (DoS) via a crafted text file.

CVSS 3.1MEDIUM 5.5 Local No auth User interaction EPSS 0.00312 Published 2023-07-26 No fix listed CWE-120

TI-2012-04514 CVE-2012-5340 · GHSA-g8x3-qg8h-3qqr

SumatraPDF 2.1.1/MuPDF 1.0 allows remote attackers to cause an Integer Overflow in the…

HIGH 69

SumatraPDF 2.1.1/MuPDF 1.0 allows remote attackers to cause an Integer Overflow in the lex_number() function via a corrupt PDF file.

CVSS 3.1HIGH 7.8 Local No auth User interaction EPSS 0.05731 Published 2020-01-23 No fix listed CWE-190

TI-2013-02473 CVE-2013-2830 · GHSA-pxq3-h2cm-cxrj

Use-after-free vulnerability in SumatraPDF Reader 2.x before 2.2.1 allows remote…

MEDIUM 40

Use-after-free vulnerability in SumatraPDF Reader 2.x before 2.2.1 allows remote attackers to execute arbitrary code via a crafted PDF file.

CVSS 3.1HIGH 7.8 Local No auth User interaction EPSS 0.03629 Published 2018-02-08 No fix listed CWE-416

TI-2012-04138 CVE-2012-4896 · GHSA-q9xm-6wgc-cfhr

Heap-based buffer overflow in SumatraPDF before 2.1 allows remote attackers to execute…

MEDIUM 48

Heap-based buffer overflow in SumatraPDF before 2.1 allows remote attackers to execute arbitrary code via a crafted PDF document, a different vulnerability than CVE-2012-4895.

CVSS 2.0HIGH 9.3 Network No auth Interaction — EPSS 0.05193 Published 2012-10-05 No fix listed CWE-119

TI-2012-04137 CVE-2012-4895 · GHSA-678j-gm52-3vq4

Heap-based buffer overflow in SumatraPDF before 2.1 allows remote attackers to execute…

MEDIUM 48

Heap-based buffer overflow in SumatraPDF before 2.1 allows remote attackers to execute arbitrary code via a crafted PDF document, a different vulnerability than CVE-2012-4896.

CVSS 2.0HIGH 9.3 Network No auth Interaction — EPSS 0.05193 Published 2012-10-05 No fix listed CWE-119

Vulnerabilities

Filters