CVE-2026-25880: 
SumatraPDF vulnerability analysis and mitigation

CVE-2026-25880 is an Untrusted Search Path vulnerability (CWE-426) in SumatraPDF Reader for Windows that allows arbitrary code execution via binary hijacking. When a user opens a PDF file and clicks File → "Show in folder", the application resolves explorer.exe relative to the directory containing the PDF rather than using the trusted system path, allowing a malicious explorer.exe placed in the same directory to execute. All versions up to and including 3.5.2 are affected. The vulnerability carries a CVSS v3.1 base score of 7.8 (High) (GitHub Advisory, Red Hat CVE).

The root cause is improper executable path resolution classified as CWE-426 (Untrusted Search Path). The "Show in folder" feature is expected to invoke the Windows file explorer using an absolute, trusted system path (e.g., C:\Windows\explorer.exe), but instead resolves explorer.exe relative to the working directory of the currently opened PDF file first. An attacker exploits this by placing a trojanized explorer.exe in the same directory as a crafted PDF; when the victim clicks the menu option, SumatraPDF executes the attacker-controlled binary without any warning. A proof-of-concept demonstrating the issue (including a PoC video) is publicly available in the GitHub Security Advisory (GitHub Advisory).

Successful exploitation results in arbitrary code execution on the victim's system with the privileges of the currently logged-in user, yielding high confidentiality, integrity, and availability impacts. Attack scenarios include distributing a malicious PDF alongside a trojanized explorer.exe via shared network folders, email attachments, or removable media. The executed payload can be used to install malware, establish persistence, exfiltrate sensitive data, or facilitate lateral movement within a network (GitHub Advisory).

A proof-of-concept exploit is publicly available in the GitHub Security Advisory, including a demonstration video showing calc.exe launched via the hijacked explorer.exe. As of the available intelligence, there is no evidence of active in-the-wild exploitation or threat actor attribution. The EPSS score is approximately 0.015% (0.000150), indicating a currently low probability of widespread exploitation. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog (GitHub Advisory).

1. Prepare malicious binary: Compile or obtain a malicious executable and rename it explorer.exe. The binary should perform the attacker's desired action (e.g., establish a reverse shell, drop malware, or launch a legitimate explorer.exe alongside the payload to avoid suspicion).
2. Stage the attack directory: Place both the malicious explorer.exe and a crafted PDF file in the same directory — this could be a shared network folder, a USB drive, a cloud-synced folder, or an email attachment delivered as a ZIP archive.
3. Social engineer the victim: Deliver the PDF to the target via phishing email, shared drive, or other means, encouraging them to open it with SumatraPDF.
4. Trigger the vulnerability: Once the victim opens the PDF in SumatraPDF (version ≤ 3.5.2) and clicks File → "Show in folder", the application resolves explorer.exe relative to the PDF's directory and executes the attacker-controlled binary.
5. Achieve code execution: The malicious explorer.exe runs with the privileges of the logged-in user, enabling further actions such as persistence establishment, credential harvesting, or lateral movement (GitHub Advisory).

• File System: Presence of an explorer.exe file in a non-standard directory (i.e., outside C:\Windows\ or C:\Windows\SysWOW64\) alongside a PDF file; unexpected executables in shared folders, download directories, or removable media.
• Process: explorer.exe process spawned with a working directory or image path outside of C:\Windows\; SumatraPDF (SumatraPDF.exe) spawning unexpected child processes.
• Logs: Windows Security Event Log entries (Event ID 4688) showing process creation of explorer.exe from a non-standard path; Sysmon Event ID 1 logs showing explorer.exe launched from a user-writable directory.
• Network: Unexpected outbound network connections originating from a process named explorer.exe running from a non-system path (indicative of a reverse shell or C2 beacon).

The GitHub Security Advisory notes that versions prior to 3.5.2 are affected; users should upgrade SumatraPDF to a version released after February 23, 2026 (when the patch details were published). Until patching is complete, users should avoid opening PDF files from untrusted or shared directories, and organizations should implement application whitelisting or code signing enforcement to prevent execution of unauthorized binaries. Additional mitigations include monitoring file system activity in directories where PDFs are frequently accessed and restricting access to the "Show in folder" feature via organizational policy (GitHub Advisory).

The vulnerability was reported by security researcher MarioRL0 and published by the SumatraPDF maintainer (kjk) on GitHub on February 9, 2026. A post on Bluesky by The Hacker Wire noted the disclosure shortly after publication. No major vendor statements beyond the GitHub advisory or significant media coverage have been identified at this time (GitHub Advisory).