The vulnerability of the PDF, EPUB, MOBI, FB2, CHM, XPS, and DjVu viewing program SumatraPDF lies in the use of an insecure search path, allowing attackers to execute arbitrary code.

The vulnerability of the PDF, EPUB, MOBI, FB2, CHM, XPS, and DjVu viewing program SumatraPDF lies in the use of an unreliable search path during the processing of Advanced Options. Exploiting this vulnerability allows a attacker to execute arbitrary code by sending a specially created malicious...

CVE-2026-23512 SumatraPDF has an Untrusted Search Path in sumatrapdf/src/AppTools.cpp

SumatraPDF is a multi-format reader for Windows. In 3.5.2 and earlier, there is a Untrusted Search Path vulnerability when Advanced Options setting is trigger. The application executes notepad.exe without specifying an absolute path when using the Advanced Options setting. On Windows, this allows...