{"id":"CVE-2026-115758","kind":"vulnerability","aliases":["CVE-2026-115758"],"related":[],"title":"SumatraPDF: certificate hostname check disabled for update and symbol downloads","description":"SumatraPDF is a multi-format reader for Windows. In version 3.6.1 and earlier, HttpGet() in src/base/Http_win.cpp unconditionally passes INTERNET_FLAG_IGNORE_CERT_CN_INVALID to WinINet, disabling hostname matching for HTTPS update metadata and crash-symbol requests while retaining certificate-chain validation. A network-positioned attacker with a Windows-trusted certificate for an attacker-controlled domain can impersonate the project's update host, inject promo text and a clickable URL before update metadata validation, and provide an attacker-controlled archive to ExtractSymbols(). Installer replacement is not directly possible because HttpGetToFile() validates TLS and MaybeStartUpdateDownload() restricts the download host. No fixed version is available as of this review.","summary":"SumatraPDF 3.6.1 and earlier turn off hostname matching for HTTPS update metadata and crash-symbol requests on Windows, while still checking the certificate chain. An attacker on the network with a certificate trusted by Windows for their own domain can impersonate the update host, inject promotional text and a link into the update prompt, and serve a crafted archive to the symbol extraction code.","severity":"high","cvss":8.2,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"SumatraPDF","fixed":[],"affected":"<= 3.6.1","ecosystem":"vendor"}],"ecosystems":[],"tags":["end-user-desktop","mitm","network-position","package","sumatrapdf","windows"],"not_affected_if":["built-from-source-after-bd30134","no-network-path-attacker","sumatrapdf-newer-than-3.6.1"],"how_to_check":"- Help > About: SumatraPDF 3.6.1 or earlier is affected (3.6.1 is the latest release; the fix commit bd30134 is not in any release yet). Portable/installed builds both apply. A build compiled from source after commit bd30134 is fixed.","fix":"No released fix as of 2026-11-04: latest release is 3.6.1 (Apr 2026), which is affected. The fix is committed in source (bd30134, 2026-07-29, removes INTERNET_FLAG_IGNORE_CERT_CN_INVALID from HttpGet) but no release containing it is published. Move to the first release after 3.6.1 once it ships.","status":"open","published_at":"2026-11-04T21:17:52+00:00","first_seen_at":"2026-11-04T21:49:18+00:00","triaged_at":"2026-11-04T21:50:44+00:00","updated_at":"2026-11-04T21:54:24+00:00","category":"package","confidence":0.85,"triage":{"at":"2026-11-04T21:50:44Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"network","title":"SumatraPDF: certificate hostname check disabled for update and symbol downloads","impact":"low","summary":"SumatraPDF 3.6.1 and earlier turn off hostname matching for HTTPS update metadata and crash-symbol requests on Windows, while still checking the certificate chain. An attacker on the network with a certificate trusted by Windows for their own domain can impersonate the update host, inject promotional text and a link into the update prompt, and serve a crafted archive to the symbol extraction code.","audience":"everyone","category":"package","nicknames":[],"who_cares":["windows","sumatrapdf","end-user-desktop"],"confidence":0.6,"fix_status":"none","needs_auth":"no","worst_case":"Attacker injects promo text and link into update prompt","analyst_note":"Confirm whether a fixed version exists at the linked GitHub patch and advisory pages; sources state none yet.","how_to_check":"- Check the installed SumatraPDF version (Help > About) against `3.6.1`\n- unknown for other checks","plain_action":"If you use SumatraPDF on Windows, the sources say no fixed version exists yet, so keep it closed to untrusted networks and wait for an update from the project.","needs_analyst":true,"not_affected_if":["sumatrapdf-newer-than-3.6.1","no-network-path-attacker"],"who_is_affected":"Windows users running SumatraPDF 3.6.1 or earlier are exposed when the update check or crash-symbol download runs on a network an attacker can sit on, such as public Wi-Fi. Installer replacement is stated as not directly possible, so the impact is limited to injected promo text, a clickable URL, and a crafted archive passed to symbol extraction.","user_interaction":"yes","needs_special_setup":"no","severity_if_unknown":"high"},"cost_usd":0.000754,"input_tokens":4316,"output_tokens":645,"severity_before":"high"},"analyst_status":"done","analyst_note":"Confirm whether a fixed version exists at the linked GitHub patch and advisory pages; sources state none yet.","search":"'-115758':13A,16A '-2026':12A,15A '3.6.1':30B,105C 'archiv':88B,180C 'attack':55B,143C,153C,178C 'attacker-control':152C,177C 'avail':203C 'cert':116C 'certif':2A,52B,61B,136C,149C 'certificate-chain':135C 'chain':53B,137C 'check':4A,50B 'clickabl':168C 'cn':117C 'code':93B 'control':154C,179C 'craft':87B 'crash':43B,130C 'crash-symbol':42B,129C 'cve':11A,14A 'desktop':21B 'direct':187C 'disabl':5A,121C 'domain':68B,155C 'download':10A,197C 'earlier':32B,107C 'end':19B 'end-user-desktop':18B 'extract':92B 'extractsymbol':182C 'fix':200C 'flag':114C 'format':99C 'host':73B,162C,198C 'hostnam':3A,35B,122C 'httpget':108C 'httpgettofil':190C 'https':38B,125C 'ignor':115C 'imperson':70B,157C 'inject':74B,163C 'instal':183C 'internet':113C 'invalid':118C 'link':79B 'match':36B,123C 'maybestartupdatedownload':194C 'metadata':40B,127C,172C 'mitm':22B 'multi':98C 'multi-format':97C 'network':24B,58B,141C 'network-posit':23B,140C 'packag':26B 'pass':112C 'posit':25B,142C 'possibl':188C 'project':159C 'promo':164C 'promot':75B 'prompt':83B 'provid':175C 'reader':100C 'replac':184C 'request':45B,132C 'restrict':195C 'retain':134C 'review':207C 'serv':85B 'src/base/http_win.cpp':110C 'still':49B 'sumatrapdf':1A,17A,27B,29B,94C 'symbol':9A,44B,91B,131C 'text':76B,165C 'tls':192C 'trust':62B,148C 'turn':33B 'uncondit':111C 'updat':7A,39B,72B,82B,126C,161C,171C 'url':169C 'user':20B 'valid':138C,173C,191C 'version':104C,201C 'window':28B,47B,64B,102C,147C 'windows-trust':146C 'wininet':120C","nicknames":[],"mitigations":[],"who_affected":"Windows users running SumatraPDF 3.6.1 or earlier, which checks for updates automatically. Exposed only if an attacker controls the network path (hostile Wi-Fi, compromised router or proxy, DNS spoofing) and holds a certificate Windows trusts for their own domain. Impact per the maintainer is injected promo text and a clickable link in the app home page and a crafted crash-symbol archive; replacing the installer is not directly possible, since the installer download validates TLS and is limited to www.sumatrapdfreader.org.","tier":"B","verified":{"fix":{"at":"2026-11-04T21:54:24Z","by":"analyst","doc":"https://github.com/sumatrapdfreader/sumatrapdf/commit/bd30134175e897dd5ed0d7fd14acce52eeca7183","run_id":1721},"products":{"at":"2026-11-04T21:54:24Z","by":"analyst","doc":"https://github.com/sumatrapdfreader/sumatrapdf/commit/bd30134175e897dd5ed0d7fd14acce52eeca7183","run_id":1721},"how_to_check":{"at":"2026-11-04T21:54:24Z","by":"analyst","doc":"https://github.com/sumatrapdfreader/sumatrapdf/commit/bd30134175e897dd5ed0d7fd14acce52eeca7183","run_id":1721},"who_affected":{"at":"2026-11-04T21:54:24Z","by":"analyst","doc":"https://github.com/sumatrapdfreader/sumatrapdf/commit/bd30134175e897dd5ed0d7fd14acce52eeca7183","run_id":1721}},"analyst_revisit_at":null,"fix_status":"none","audience":"everyone","plain_action":"If you use SumatraPDF on Windows, the sources say no fixed version exists yet, so keep it closed to untrusted networks and wait for an update from the project.","pkeys":["sumatrapdf"],"ptokens":["sumatrapdf"],"labels":["enduserdesktop","high","mitm","networkposition","package","sumatrapdf","windows"],"campaign_type":null,"first_public_at":"2026-07-29T19:00:55+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"security-advisories@github.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-115758","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-115758","severity":null,"published_at":"2026-11-04T21:17:52+00:00","modified_at":"2026-11-04T21:17:52+00:00","first_seen_at":"2026-11-04T21:49:18+00:00","fetched_at":"2026-11-04T21:49:18+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-115758:1721","url":null,"severity":null,"published_at":"2026-11-04T21:54:24+00:00","modified_at":"2026-11-04T21:54:24+00:00","first_seen_at":"2026-11-04T21:54:24+00:00","fetched_at":"2026-11-04T21:54:24+00:00","note":"Read vendor GHSA-mjwr-9w29-jp96 (Moderate per maintainer; NVD/CNA 8.2) and fix commit bd30134; releases page shows 3.6.1 (Apr) as latest, so no released fix yet. Not exploited, no PoC seen. Skipped social search."}],"documents":[{"id":70627,"url":"https://github.com/sumatrapdfreader/sumatrapdf/commit/bd30134175e897dd5ed0d7fd14acce52eeca7183","title":"Patch: github.com","kind":"other","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Patch: github.com"},{"id":70628,"url":"https://github.com/sumatrapdfreader/sumatrapdf/security/advisories/GHSA-mjwr-9w29-jp96","title":"Vendor advisory: github.com","kind":"vendor","source":"nvd","publisher":"vendor","text":null,"published_at":"2026-07-29T19:00:55+00:00","relation":"advisory","confidence":null,"note":"Vendor advisory: github.com"}],"exploit_sources":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}