Untrusted Search Path Vulnerability in SumatraPDF by Krzysztof Kowalczyk

CVE-2026-23512

What is CVE-2026-23512?

SumatraPDF, a versatile document reader for Windows, is susceptible to an untrusted search path flaw in versions 3.5.2 and earlier. This vulnerability occurs when users invoke the Advanced Options setting, allowing the application to execute notepad.exe without specifying an absolute path. An attacker could exploit this by placing a malicious version of notepad.exe in the application's directory, leading to the potential execution of arbitrary code on the system. Users are advised to be cautious and consider updating to mitigate this risk.

References