CVE-2026-23512: 
SumatraPDF vulnerability analysis and mitigation

CVE-2026-23512 is an Untrusted Search Path vulnerability (CWE-426) in SumatraPDF, a multi-format document reader for Windows. The flaw affects SumatraPDF version 3.5.2 and earlier, and was published on January 14, 2026, with the security advisory authored by researcher MarioRL0 and published by project maintainer kjk. When a user triggers the Advanced Options setting, the application invokes notepad.exe without an absolute path, allowing a malicious executable placed in the installation directory to be executed instead. The vulnerability carries a CVSS v3.1 base score of 7.8 (High) per NVD, and 8.6 (High) per the GitHub advisory using a scope-changed vector (GitHub Advisory, Feedly).

The root cause is classified as CWE-426 (Untrusted Search Path): in sumatrapdf/src/AppTools.cpp, the editorRules array specifies notepad.exe as a plain filename without an absolute path, causing Windows to resolve it via the current working directory or PATH before the system directory. The fix, committed as 2762e02, changes the resolution method to RegType::BinaryPath and reads the SystemRoot value from the Windows registry key HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion, ensuring the legitimate system notepad.exe is always invoked. Exploitation requires that an attacker has already placed a malicious notepad.exe in the SumatraPDF installation directory — a precondition that typically requires local write access or a prior compromise — and that the victim triggers the Advanced Options setting with Notepad set as the default text editor (GitHub Advisory, Patch Commit).

Successful exploitation results in arbitrary code execution with the privileges of the user running SumatraPDF, impacting confidentiality, integrity, and availability. An attacker can use the malicious notepad.exe to exfiltrate sensitive data, modify or delete files, install persistent malware, or disrupt services on the affected system. The scope of impact is limited to the local user context (no privilege escalation to SYSTEM is inherent), but the attack can serve as a foothold for further lateral movement within a network (GitHub Advisory).

A proof-of-concept (PoC) video demonstrating the vulnerability is included in the GitHub security advisory, showing a malicious notepad.exe placed in the SumatraPDF directory that triggers calc.exe and writes an exploit_success.txt file upon execution. There is no evidence of in-the-wild exploitation at this time, and the vulnerability has not been added to the CISA Known Exploited Vulnerabilities (KEV) catalog. The EPSS score is approximately 0.014% (0.000140), reflecting a low probability of near-term exploitation (GitHub Advisory, Feedly).

1. Gain write access to the installation directory: Obtain local write permissions to the SumatraPDF installation directory (e.g., C:\Program Files\SumatraPDF\) through a prior compromise, social engineering, or by targeting a user-level installation where the current user has write access.
2. Craft a malicious notepad.exe: Compile or obtain a malicious executable (e.g., a reverse shell, dropper, or PoC payload like one that spawns calc.exe) and name it notepad.exe.
3. Place the malicious executable: Copy the malicious notepad.exe into the SumatraPDF installation directory, overwriting or coexisting alongside the legitimate application files.
4. Trigger the Advanced Options setting: Wait for or socially engineer the victim to open SumatraPDF and navigate to Settings → Advanced Options, which causes the application to invoke notepad.exe without an absolute path.
5. Achieve code execution: Windows resolves notepad.exe from the application's directory before the system directory, executing the malicious binary with the privileges of the logged-in user, enabling arbitrary code execution (GitHub Advisory).

• File System: Presence of an unexpected or modified notepad.exe in the SumatraPDF installation directory (e.g., C:\Program Files\SumatraPDF\notepad.exe); creation of anomalous files such as exploit_success.txt in user-accessible directories.
• Process: Unusual child processes spawned by SumatraPDF.exe (e.g., calc.exe, cmd.exe, powershell.exe, or network-connecting processes) instead of the expected C:\Windows\System32\notepad.exe; notepad.exe process image path resolving to the SumatraPDF directory rather than %SystemRoot%\System32\.
• Logs: Windows Event Logs (Security, Event ID 4688) showing process creation of notepad.exe with an image path outside %SystemRoot%; file integrity monitoring alerts on the SumatraPDF installation directory.

The vulnerability is patched in the commit 2762e02 to the SumatraPDF repository, which resolves notepad.exe via the Windows registry SystemRoot value rather than an unqualified path search; users should upgrade to a version of SumatraPDF newer than 3.5.2 once a patched release is available (Patch Commit). As interim workarounds, administrators should restrict write permissions on the SumatraPDF installation directory to prevent unauthorized placement of executables, and users should avoid triggering the Advanced Options setting if the installation directory's integrity cannot be verified. Monitoring the installation directory for unauthorized file modifications using file integrity monitoring tools is also recommended (GitHub Advisory).

The vulnerability was reported by security researcher MarioRL0 and published via GitHub's security advisory program on January 14, 2026. Coverage appeared on security aggregation sites including The Hacker Wire, Vulners, VulDB, and CVEFeed shortly after disclosure, and the advisory was noted on Bluesky and Mastodon by CVE tracking accounts. No major vendor statements beyond the SumatraPDF maintainer's patch commit have been issued, and community reaction has been moderate given the local-access precondition required for exploitation (GitHub Advisory).