SumatraPDF: TLS hostname validation disabled in `HttpGet()`
Affects SumatraPDF 3.6.1 and earlier on Windows, where HttpGet() skips hostname checks in WinINet. No vendor rating or fixed version is listed in the checked facts.
Written by anthropic/claude-haiku-5.5 from the sources below. Verify against them.
- Exploited
- No known exploitation
- Fix
- No fix listed
- Who is exposed
- Default setups
Do first: Check every install: default setups are affected.
- Exploitation?/40Exploitation: unknown (data gap). No CISA SSVC exploitation rating yet
- Exposure22/25Default setups, reachable over the network without a login
- Reach?/20Reach: unknown (data gap). No tracked technology or package matched
- Severity8.2/10CVSS 8.2
- No patch5/5No patch listed yet
What would change the score
- Would score about 75 if added to CISA KEV
- Would score about 70 if CISA's SSVC rates exploitation active
CVE-2026-115758 is not in CISA's Known Exploited Vulnerabilities (KEV) catalog. No public exploit code is tracked. It is rated CVSS 8.2 (high) and affects sumatrapdf; no fixed version is listed yet.
- Last modified
- Where the record stands: published, rejected by its publisher, or superseded by another id.What do these mean? →
- Published
- Whether CISA lists it in its Known Exploited Vulnerabilities catalog: proof that attackers are using it.What do these mean? →
- Not listed in CISA KEV
- A 0-100 score for how much a CVE matters across the industry: exploitation, exposure, how widely the software is used, severity and whether a fix exists.What do these mean? →
- 35/100 · provisional
- How many real-world setups can hit the bug, from the vendor's advisory and CISA data. It does not know your setup.What do these mean? →
- Default setups
- Whether working attack code is public (Exploit-DB, Metasploit, Nuclei or GitHub). Public code makes attacks easier.What do these mean? →
- None on Exploit-DB, Metasploit or GitHub
Summary
SumatraPDF, a multi-format reader for Windows, skips hostname checks on its HTTPS update and crash-symbol requests, so a remote attacker who holds a Windows-trusted certificate for their own domain and can position themselves on the network can impersonate the update host without logging in or any action by the user. The attacker can then inject promotional text and a clickable link and supply a malicious archive for symbol extraction, but cannot directly replace the installer.
Read the original description
SumatraPDF is a multi-format reader for Windows. In version 3.6.1 and earlier, HttpGet() in src/base/Http_win.cpp unconditionally passes INTERNET_FLAG_IGNORE_CERT_CN_INVALID to WinINet, disabling hostname matching for HTTPS update metadata and crash-symbol requests while retaining certificate-chain validation. A network-positioned attacker with a Windows-trusted certificate for an attacker-controlled domain can impersonate the project's update host, inject promo text and a clickable URL before update metadata validation, and provide an attacker-controlled archive to ExtractSymbols(). Installer replacement is not directly possible because HttpGetToFile() validates TLS and MaybeStartUpdateDownload() restricts the download host. No fixed version is available as of this review.
What to do
Check every install: default setups are affected.
Workaround: The checked facts do not list a workaround. The advisory is the place to check for mitigation guidance while no fix is available.
Timeline
- CVE published
- First seen by cve.now
Affected versions
- sumatrapdfreader sumatrapdf
through 3.6.1
Evidence 2
- Advisory
- Repository
Corrections
None so far.
Something wrong on this page? Report an error. Every fix is listed here.
Questions about CVE-2026-115758
Is CVE-2026-115758 being exploited?
It is not in CISA's Known Exploited Vulnerabilities catalog, and CISA's SSVC assessment does not mark exploitation as active. That does not mean it has not been attacked: vendors and researchers can report attacks before CISA lists them. No public exploit code is tracked.Source: cve.now feed data
What does this mean?
HttpGet() tells WinINet to ignore whether a server's certificate matches the host name it was asked for. A server presenting a certificate chain that Windows trusts for another domain could therefore be accepted as the update-check or crash-symbol host. That could let an impersonating server inject promo text and a clickable URL into the home page, or supply an archive to the crash-symbol extractor.Source: github.com
Which versions are affected by CVE-2026-115758?
sumatrapdf: through 3.6.1.Source: cve.now feed data
Am I affected, and how do I check?
Versions up to and including 3.6.1 are listed as affected, on Windows builds where HttpGet() uses WinINet. Check the installed version in the program's About dialog and compare it with the affected range in the advisory.Source: github.com
How do I fix CVE-2026-115758?
The checked facts do not name a fixed version, so no upgrade target can be given. Check the advisory for a fixed release and install it when one is published.Source: github.com
What if there's no patch?
The checked facts do not list a workaround. The advisory is the place to check for mitigation guidance while no fix is available.Source: github.com