Impersonation Vulnerability in SumatraPDF by Žan Kobal
CVE-2026-115758

8.2HIGH

Key Information:

Vendor

SumatraPDFreader

Status
SumatraPDF
Vendor
CVE Published:
4 November 2026

What is CVE-2026-115758?

SumatraPDF, a popular multi-format reader for Windows, has a vulnerability in its handling of HTTPS updates due to flawed logic in the HttpGet() function. Specifically, versions 3.6.1 and earlier pass a flag that disables hostname matching, allowing a network-based attacker with a valid, malicious certificate to impersonate legitimate update servers. This flaw could enable attackers to disrupt user experiences by injecting promotional content and providing misleading URLs alongside an attacker-controlled archive during the update process. At present, no fix has been announced for this vulnerability.

Affected Version(s)

sumatrapdf <= 3.6.1

References

https://github.com/sumatrapdfreader/sumatrapdf/security/a...
x_refsource_CONFIRM
https://github.com/sumatrapdfreader/sumatrapdf/commit/bd3...
x_refsource_MISC

CVSS V4

Score:
8.2
Severity:
HIGH
Confidentiality:
None
Integrity:
High
Availability:
None
Attack Vector:
Network
Attack Complexity:
High
Attack Required:
Physical
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.