CVE-2023-33802

CVE-2023-33802 SumatraPDF 3.4.6 -32位拒绝服务（DoS） 描述 在此漏洞中，当我们在SumatraPDF 32位中打开两个大型文本文件（first.txt & second.txt）作为输入时，会出现崩溃。 运行以下命令，或者您可以手动在SumatraPDF 32位3.4.6中同时打开这两个文件。 root@kitploit: SumatraPDF.exe first.txt second.txt 使用WinDBG分析32位版本3.4.6应用程序的崩溃报告 遇到以下崩溃。 root@kitploit: Microsoft R Windows Debugg...

CVE-2026-25961-SumatraPDF-3.5.0---3.5.2-RCE

PoC de Actualización Insegura de SumatraPDF CVE-2026-25961 – Ejecución Remota de Código mediante un Servidor de Actualización Malicioso Autor: Mohammed Idrees Banyamer Fecha: Febrero de 2026 CVE: CVE-2026-25961 GHSA: GHSA-xpm2-rr5m-x96q CVSS v3.1: 7.5 Alta AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H...

CVE-2026-55586

SumatraPDF is a multi-format reader for Windows. In 3.6.1 and earlier, a crafted CHM file can supply malformed LZX Huffman code lengths to makedecodetable in ext/CHMLib/lzx.c. In the long-code branch, the function writes new internal nodes through nextsymbol before validating that the canonical...

EUVD-2026-63469

SumatraPDF is a multi-format reader for Windows. In 3.6.1 and earlier, a crafted CHM file can supply malformed LZX Huffman code lengths to makedecodetable in ext/CHMLib/lzx.c. In the long-code branch, the function writes new internal nodes through nextsymbol before validating that the canonical...

CVE-2026-55586 SumatraPDF: Heap out-of-bounds write in vendored CHMLib LZX Huffman table construction reachable from crafted CHM files

SumatraPDF is a multi-format reader for Windows. In 3.6.1 and earlier, a crafted CHM file can supply malformed LZX Huffman code lengths to makedecodetable in ext/CHMLib/lzx.c. In the long-code branch, the function writes new internal nodes through nextsymbol before validating that the canonical...

CVE-2026-55586

SumatraPDF 3.6.1 and earlier (Windows) contains a heap out-of-bounds write in the vendored CHMLib LZX decompressor. A crafted CHM file can supply malformed Huffman code lengths to make_decode_table in ext/CHMLib/lzx.c. In the long-code branch, internal nodes are written via next_symbol before val...

CVE-2026-55586 SumatraPDF: Heap out-of-bounds write in vendored CHMLib LZX Huffman table construction reachable from crafted CHM files

SumatraPDF is a multi-format reader for Windows. In 3.6.1 and earlier, a crafted CHM file can supply malformed LZX Huffman code lengths to makedecodetable in ext/CHMLib/lzx.c. In the long-code branch, the function writes new internal nodes through nextsymbol before validating that the canonical...

PT-2026-79059

Name of the Vulnerable Software and Affected Versions SumatraPDF versions prior to 3.6.2 Description A crafted CHM file can provide malformed LZX Huffman code lengths to the make decode table function in ext/CHMLib/lzx.c. In the long-code branch, the function writes new internal nodes via next...

SumatraPDF 3.5.2 - Remote Code Execution

Exploit Title: SumatraPDF 3.5.2 - Remote Code Execution Date: 2026-02-10 Exploit Author: Mohammed I. Banyamer Vendor Homepage: https://www.sumatrapdfreader.org/ Software Link: https://www.sumatrapdfreader.org/download-free-pdf-viewer Version: 3.5.0 - 3.5.2 Tested on: Windows 10 / 11 CVE :...

Tropic Trooper Uses Trojanized SumatraPDF and GitHub to Deploy AdaptixC2

Chinese-speaking individuals are the target of a new campaign that uses a trojanized version of SumatraPDF reader to deploy the AdaptixC2 Beacon post-exploitation agent and ultimately facilitate the abuse of Microsoft Visual Studio Code VS Code tunnels for remote access. Zscaler ThreatLabz, which...

CVE-2026-25920

SumatraPDF is a multi-format reader for Windows. In 3.5.2 and earlier, a heap out-of-bounds read vulnerability exists in SumatraPDF's MOBI HuffDic decompressor. The bounds check in AddCdicData only validates half the range that DecodeOne actually accesses. Opening a crafted .mobi file can read...

CVE-2026-25880

SumatraPDF is a multi-format reader for Windows. In 3.5.2 and earlier, the PDF reader allows execution of a malicious binary explorer.exe located in the same directory as the opened PDF when the user clicks File → “Show in folder”. This behavior leads to arbitrary code execution on the victim’s...

CVE-2026-25961

SumatraPDF is a multi-format reader for Windows. In 3.5.0 through 3.5.2, SumatraPDF's update mechanism disables TLS hostname verification INTERNETFLAGIGNORECERTCNINVALID and executes installers without signature checks. A network attacker with any valid TLS certificate e.g., Let's Encrypt can...

Exploit for CVE-2026-25961

SumatraPDF Insecure Update PoC CVE-2026-25961 – Remote C...

CVE-2026-25920

SumatraPDF is a multi-format reader for Windows. In 3.5.2 and earlier, a heap out-of-bounds read vulnerability exists in SumatraPDF's MOBI HuffDic decompressor. The bounds check in AddCdicData only validates half the range that DecodeOne actually accesses. Opening a crafted .mobi file can read...

CVE-2026-25880

SumatraPDF is a multi-format reader for Windows. In 3.5.2 and earlier, the PDF reader allows execution of a malicious binary explorer.exe located in the same directory as the opened PDF when the user clicks File → “Show in folder”. This behavior leads to arbitrary code execution on the victim’s...

CVE-2026-25961 SumatraPDF Update MITM -> Arbitrary Code Execution

SumatraPDF is a multi-format reader for Windows. In 3.5.0 through 3.5.2, SumatraPDF's update mechanism disables TLS hostname verification INTERNETFLAGIGNORECERTCNINVALID and executes installers without signature checks. A network attacker with any valid TLS certificate e.g., Let's Encrypt can...

CVE-2026-25961

CVE-2026-25961 affects SumatraPDF

CVE-2026-25961

SumatraPDF is a multi-format reader for Windows. In 3.5.0 through 3.5.2, SumatraPDF's update mechanism disables TLS hostname verification INTERNETFLAGIGNORECERTCNINVALID and executes installers without signature checks. A network attacker with any valid TLS certificate e.g., Let's Encrypt can...

CVE-2026-25961 SumatraPDF Update MITM -> Arbitrary Code Execution

SumatraPDF is a multi-format reader for Windows. In 3.5.0 through 3.5.2, SumatraPDF's update mechanism disables TLS hostname verification INTERNETFLAGIGNORECERTCNINVALID and executes installers without signature checks. A network attacker with any valid TLS certificate e.g., Let's Encrypt can...