PT-2026-137140
CVE-2026-115758
·
Published
2026-11-04
·
Updated
2026-11-04
Description by
CVSS 4.0
8.2
HighMetricsAV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Name of the Vulnerable Software and Affected Versions
SumatraPDF versions prior to 3.6.2
Description
The
HttpGet() function in src/base/Http win.cpp unconditionally passes the INTERNET FLAG IGNORE CERT CN INVALID flag to WinINet. This action disables hostname matching for HTTPS requests related to update metadata and crash symbols, although certificate-chain validation remains active. A network-positioned attacker possessing a Windows-trusted certificate for a domain they control can impersonate the update host. This allows the attacker to inject promotional text and a clickable URL before the update metadata is validated, and to provide a malicious archive to the ExtractSymbols() function.Recommendations
At the moment, there is no information about a newer version that contains a fix for this vulnerability.
Found an issue in the description? Have something to add? Feel free to write us 👾