CVE-2026-115758 in SumatraPDF
Summary
by MITRE • 11/04/2026
SumatraPDF is a multi-format reader for Windows. In version 3.6.1 and earlier, HttpGet() in src/base/Http_win.cpp unconditionally passes INTERNET_FLAG_IGNORE_CERT_CN_INVALID to WinINet, disabling hostname matching for HTTPS update metadata and crash-symbol requests while retaining certificate-chain validation. A network-positioned attacker with a Windows-trusted certificate for an attacker-controlled domain can impersonate the project's update host, inject promo text and a clickable URL before update metadata validation, and provide an attacker-controlled archive to ExtractSymbols(). Installer replacement is not directly possible because HttpGetToFile() validates TLS and MaybeStartUpdateDownload() restricts the download host. No fixed version is available as of this review.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 11/04/2026
SumatraPDF serves as a widely utilized multi-format document reader for Windows operating systems, yet it contains a significant security flaw in its network communication logic within versions 3.6.1 and earlier. The vulnerability resides specifically in the HttpGet function located in the source file src/base/Http_win.cpp. This component is responsible for handling HTTP requests to external servers, particularly those involved in checking for software updates and retrieving crash symbols necessary for debugging application failures. The core technical flaw involves the unconditional passing of the INTERNET_FLAG_IGNORE_CERT_CN_INVALID flag to the Windows Internet API WinINet during HTTPS connections. While this configuration retains certificate-chain validation, ensuring that the server presents a valid chain of trust rooted in trusted Certificate Authorities, it explicitly disables hostname matching. This means that while the cryptographic identity of the issuing authority is verified, the actual domain name presented by the server is not compared against the expected target host. Consequently, any server presenting a valid TLS certificate issued to an attacker-controlled domain can successfully authenticate as the legitimate update or symbol server from the perspective of the application's network stack.
The operational impact of this vulnerability allows for sophisticated man-in-the-middle attacks and supply chain compromises when SumatraPDF is configured to automatically check for updates or generate crash dumps that are uploaded externally. A network-positioned attacker who possesses a valid, Windows-trusted certificate for a domain they control can impersonate the official update host. By intercepting the connection request, the attacker can serve malicious content before the application proceeds with standard validation checks. Specifically, the attacker can inject promotional text and clickable URLs into the interface or metadata display area, potentially leading users to phishing sites or malware distribution platforms. Furthermore, because the vulnerability affects the mechanism used by ExtractSymbols(), an attacker could provide a crafted archive containing malicious code disguised as crash symbols. If a user interacts with these injected elements or if the application processes the compromised symbol data in a manner that leads to execution, it results in arbitrary code execution on the victim's machine. This represents a severe breach of integrity and confidentiality for users relying on automatic update mechanisms.
From an industry standards perspective, this vulnerability aligns closely with CWE-295 Improper Certificate Validation, specifically regarding the failure to verify hostname or domain name during TLS negotiation. The flaw also maps to MITRE ATT&CK technique T1078 Valid Accounts and potentially T1190 Exploit Public-Facing Application if leveraged through public update channels. Although installer replacement is mitigated because HttpGetToFile() validates TLS connections more strictly and MaybeStartUpdateDownload() restricts downloads to specific whitelisted hosts, the ability to inject UI elements and compromise crash symbol processing remains a critical risk vector. The lack of hostname verification effectively nullifies one of the primary defenses against server impersonation in HTTPS communications. Until a fixed version is released by the developers, mitigation strategies must focus on user behavior and network-level controls. Users should disable automatic update checks within the application settings to prevent unsolicited connections to external servers. Additionally, organizations can implement strict egress filtering or proxy solutions that inspect TLS traffic for certificate validity against known good domains, ensuring that even if a client ignores hostname validation, the network infrastructure enforces correct destination matching. Monitoring for unusual outbound HTTPS connections from SumatraPDF processes and auditing crash symbol upload destinations are also recommended defensive measures to detect potential exploitation attempts in real-time.