---
id: "CVE-2026-115758"
kind: "vulnerability"
aliases: ["CVE-2026-115758"]
title: "SumatraPDF: certificate hostname check disabled for update and symbol downloads"
severity: "high"
cvss: 8.2
epss: null
exploited: false
status: "open"
category: "package"
products: [{"name": "SumatraPDF", "fixed": [], "affected": "<= 3.6.1", "ecosystem": "vendor"}]
ecosystems: []
tags: ["end-user-desktop", "mitm", "network-position", "package", "sumatrapdf", "windows"]
not_affected_if: ["built-from-source-after-bd30134", "no-network-path-attacker", "sumatrapdf-newer-than-3.6.1"]
published_at: "2026-11-04T21:17:52+00:00"
first_seen_at: "2026-11-04T21:49:18+00:00"
updated_at: "2026-11-04T21:54:24+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-115758", "first_seen_at": "2026-11-04T21:49:18+00:00"}, {"source": "analyst", "url": null, "first_seen_at": "2026-11-04T21:54:24+00:00"}]
exploit_sources: []
---

# SumatraPDF: certificate hostname check disabled for update and symbol downloads

SumatraPDF 3.6.1 and earlier turn off hostname matching for HTTPS update metadata and crash-symbol requests on Windows, while still checking the certificate chain. An attacker on the network with a certificate trusted by Windows for their own domain can impersonate the update host, inject promotional text and a link into the update prompt, and serve a crafted archive to the symbol extraction code.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:SumatraPDF affected <= 3.6.1 fixed ?

## How to check

- Help > About: SumatraPDF 3.6.1 or earlier is affected (3.6.1 is the latest release; the fix commit bd30134 is not in any release yet). Portable/installed builds both apply. A build compiled from source after commit bd30134 is fixed.

## Fix

No released fix as of 2026-11-04: latest release is 3.6.1 (Apr 2026), which is affected. The fix is committed in source (bd30134, 2026-07-29, removes INTERNET_FLAG_IGNORE_CERT_CN_INVALID from HttpGet) but no release containing it is published. Move to the first release after 3.6.1 once it ships.

## Timeline

- 2026-11-04T21:49:18+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-115758
- 2026-11-04T21:54:24+00:00 analyst — Read vendor GHSA-mjwr-9w29-jp96 (Moderate per maintainer; NVD/CNA 8.2) and fix commit bd30134; releases page shows 3.6.1 (Apr) as latest, so no released fix yet. Not exploited, no PoC seen. Skipped social search.

## Documents

- [advisory] Vendor advisory: github.com https://github.com/sumatrapdfreader/sumatrapdf/security/advisories/GHSA-mjwr-9w29-jp96
- [fix] Patch: github.com https://github.com/sumatrapdfreader/sumatrapdf/commit/bd30134175e897dd5ed0d7fd14acce52eeca7183

## From the sources

SumatraPDF is a multi-format reader for Windows. In version 3.6.1 and earlier, HttpGet() in src/base/Http_win.cpp unconditionally passes INTERNET_FLAG_IGNORE_CERT_CN_INVALID to WinINet, disabling hostname matching for HTTPS update metadata and crash-symbol requests while retaining certificate-chain validation. A network-positioned attacker with a Windows-trusted certificate for an attacker-controlled domain can impersonate the project's update host, inject promo text and a clickable URL before update metadata validation, and provide an attacker-controlled archive to ExtractSymbols(). Installer replacement is not directly possible because HttpGetToFile() validates TLS and MaybeStartUpdateDownload() restricts the download host. No fixed version is available as of this review.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_