CVE-2026-25961
HIGHSumatraPDF 3.5.0-3.5.2 - Remote Code Execution via Update Mechanism TLS Hostname Verification Bypass
Title source: llmExploitation Summary
EIP tracks 3 public exploits for CVE-2026-25961. PoCs published by banyamer, XiaomingX, mbanyamer.
AI-analyzed exploit summary This PoC demonstrates a remote code execution vulnerability in SumatraPDF by serving a malicious update server that exploits the lack of TLS hostname verification and installer signature validation.
Description
SumatraPDF is a multi-format reader for Windows. In 3.5.0 through 3.5.2, SumatraPDF's update mechanism disables TLS hostname verification (INTERNET_FLAG_IGNORE_CERT_CN_INVALID) and executes installers without signature checks. A network attacker with any valid TLS certificate (e.g., Let's Encrypt) can intercept the update check request, inject a malicious installer URL, and achieve arbitrary code execution.
Exploits (3)
This PoC demonstrates a remote code execution vulnerability in SumatraPDF by serving a malicious update server that exploits the lack of TLS hostname verification and installer signature validation.
This repository contains a functional PoC for CVE-2026-25961, demonstrating how an attacker can exploit SumatraPDF's insecure update mechanism by hosting a malicious update server. The PoC includes a Flask-based server that serves a forged update response and a dummy payload, simulating the RCE attack.
This PoC demonstrates a remote code execution vulnerability in SumatraPDF 3.5.0-3.5.2 by exploiting insecure update mechanisms. It hosts a malicious update server that serves a forged update response and a dummy payload, which would execute when the victim clicks 'Install'.
References (1)
Scores
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H