CVE-2026-25961: sumatrapdfreader sumatrapdf Improper Certificate Validation
Vulnerability summary
CVE-2026-25961 is a high (CVSS 7.5) Improper Certificate Validation vulnerability in sumatrapdfreader sumatrapdf. EPSS estimates a 0.48% chance of exploitation in the next 30 days, higher than 40.6% of scored vulnerabilities. 2 public exploits are recorded.
Timeline
- 09-02-2026PublishedVulnerability first disclosed.
- 10-02-2026Last modifiedVulnerability information updated.
Description
SumatraPDF is a multi-format reader for Windows. In 3.5.0 through 3.5.2, SumatraPDF's update mechanism disables TLS hostname verification (INTERNET_FLAG_IGNORE_CERT_CN_INVALID) and executes installers without signature checks. A network attacker with any valid TLS certificate (e.g., Let's Encrypt) can intercept the update check request, inject a malicious installer URL, and achieve arbitrary code execution.
CVSS metrics
2 scores · 2 sources · 1 version- NVDNIST7.5HighCVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
EPSS trend
Probability
0.48%
Chance of exploitation in the next 30 days
Percentile
41%
Versus all other CVEs
30-day change
+0.03 pp
From 0.45% on 21-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
2 foundSumatrapdf
Maturity: poc
SumatraPDF 3.5.2 - Remote Code Execution
Maturity: poc
Weaknesses
CWE · root cause- CWE-295Improper Certificate ValidationThe product does not validate, or incorrectly validates, a certificate.
- CWE-494Download of Code Without Integrity CheckThe product downloads source code or an executable from a remote location and executes the code without sufficiently verifying the origin and integrity of the code.
Affected systems
Sumatrapdfreader1 product
- sumatrapdf≥ 3.5.0, ≤ 3.5.2 | ≥ 3.5, ≤ 3.5.2
1 vendor · 1 product
References
1 links- github.com/sumatrapdfreader/sumatrapdf/security/advisories/GHSA-xpm2-rr5m-x96qX Refsource CONFIRMExploitVendor Advisory