SUMATRAPDF · CVE-2026-115758 · Package
NO FIX YET · SEE WHAT TO DO
SumatraPDF 3.6.1 and earlier turn off hostname matching for HTTPS update metadata and crash-symbol requests on Windows, while still checking the certificate chain. An attacker on the network with a certificate trusted by Windows for their own domain can impersonate the update host, inject promotional text and a link into the update prompt, and serve a crafted archive to the symbol extraction code.
first public Jul 29, 2026 · 2 sources
Check it with your coding agent
It checks your repository and tells you if you’re affected, with the fix.
Windows users running SumatraPDF 3.6.1 or earlier, which checks for updates automatically. Exposed only if an attacker controls the network path (hostile Wi-Fi, compromised router or proxy, DNS spoofing) and holds a certificate Windows trusts for their own domain. Impact per the maintainer is injected promo text and a clickable link in the app home page and a crafted crash-symbol archive; replacing the installer is not directly possible, since the installer download validates TLS and is limited to www.sumatrapdfreader.org.
Not affected if built-from-source-after-bd30134, no-network-path-attacker, sumatrapdf-newer-than-3.6.1
Who cares end-user-desktop, mitm, network-position, sumatrapdf, windows
SumatraPDF is a multi-format reader for Windows. In version 3.6.1 and earlier, HttpGet() in src/base/Http_win.cpp unconditionally passes INTERNET_FLAG_IGNORE_CERT_CN_INVALID to WinINet, disabling hostname matching for HTTPS update metadata and crash-symbol requests while retaining certificate-chain validation. A network-positioned attacker with a Windows-trusted certificate for an attacker-controlled domain can impersonate the project's update host, inject promo text and a clickable URL before update metadata validation, and provide an attacker-controlled archive to ExtractSymbols(). Installer replacement is not directly possible because HttpGetToFile() validates TLS and MaybeStartUpdateDownload() restricts the download host. No fixed version is available as of this review.
This page as .md ·
Are you affected?
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
3.6.1 (Apr 2026), which is affected3.6.1 once it shipsNVD data is provided by NIST and is public domain. Posts quoted belong to their authors.