Arbitrary Code Execution Vulnerability in SumatraPDF by David Huynh
CVE-2026-25880

7.8HIGH

Key Information:

Vendor

SumatraPDFreader

Status
SumatraPDF
Vendor
CVE Published:
9 February 2026

What is CVE-2026-25880?

In SumatraPDF, a popular multi-format reader for Windows, a vulnerability has been identified that permits the execution of a malicious binary lurking within the same directory as an opened PDF file. When a user executes the 'Show in folder' option from the File menu, the application inadvertently launches the malicious executable (e.g., explorer.exe), allowing for potential arbitrary code execution. This behavior takes place without any prompts or additional user actions beyond the initial menu selection, posing significant security risks to users of version 3.5.2 and earlier.

Affected Version(s)

sumatrapdf <= 3.5.2

References

https://github.com/sumatrapdfreader/sumatrapdf/security/a...
x_refsource_CONFIRM

CVSS V3.1

Score:
7.8
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Local
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.