Sumatrapdfreader vulnerabilities
We track 8 vulnerabilities in Sumatrapdfreader products. 8 are rated high or critical, and none are known to be exploited. The most recent was published on November 4, 2026.
Latest Sumatrapdfreader vulnerabilities
- 8.2 High severity
sumatrapdf: Improper Validation of Certificate with Host Mismatch
SumatraPDF is a multi-format reader for Windows. In version 3.6.1 and earlier, HttpGet() in src/base/Http_win.cpp unconditionally passes INTERNET_FLAG_IGNORE_CERT_CN_INVALID to WinINet, disabling hostname matching for HTTPS update metadata and crash-symbol req
- 7.1 High severity
sumatrapdf: Improper Neutralization of Argument Delimiters in a Command
SumatraPDF is a multi-format reader for Windows. In 3.6.1 and earlier, src/SelectionTranslate.cpp embeds selected or pasted translation text in quoted Windows command lines using incomplete quote-only escaping. The affected BuildGrokTranslateCmdLineTemp(), Bui
- 7.1 High severity
SumatraPDF is a multi-format reader for Windows.
SumatraPDF is a multi-format reader for Windows. In 3.5.2 and earlier, an attacker-controlled SyncTeX source filename is substituted for the %f placeholder in an external editor command line without safe Windows argument quoting, and the resulting command line
- 8.4 High severity
sumatrapdf: Improper Control of Generation of Code
SumatraPDF is a multi-format reader for Windows. In 3.6.1 and earlier, untrusted document paths and PDF link targets are interpolated into notification text that ParseTip() interprets as trusted tip markup. When a user clicks an injected link, ExecuteTipLink()
- 7.5 High severity
sumatrapdf: Download of Code Without Integrity Check
SumatraPDF is a multi-format reader for Windows. In 3.5.0 through 3.5.2, SumatraPDF's update mechanism disables TLS hostname verification (INTERNET_FLAG_IGNORE_CERT_CN_INVALID) and executes installers without signature checks. A network attacker with any valid
- 7.8 High severity
sumatrapdf: Untrusted Search Path
SumatraPDF is a multi-format reader for Windows. In 3.5.2 and earlier, the PDF reader allows execution of a malicious binary (explorer.exe) located in the same directory as the opened PDF when the user clicks File → “Show in folder”. This behavior leads to arb
- 7.8 High severity
sumatrapdf: Untrusted Search Path
SumatraPDF is a multi-format reader for Windows. In 3.5.2 and earlier, there is a Untrusted Search Path vulnerability when Advanced Options setting is trigger. The application executes notepad.exe without specifying an absolute path when using the Advanced Opt
- 7.3 High severity
Sumatrapdf: NULL Pointer Dereference
A null pointer dereference vulnerability was discovered in SumatraPDF 3.5.2 during the processing of a crafted .djvu file. When the file is opened, the application crashes inside libmupdf.dll, specifically in the DataPool::has_data() function.