GHSA-mjwr-9w29-jp96: SumatraPDF: TLS hostname validation disabled in `HttpGet()`

Published Nov 4, 2026

Updated

SumatraPDF is a multi-format reader for Windows. In version 3.6.1 and earlier, HttpGet() in src/base/Httpwin.cpp unconditionally passes INTERNETFLAGIGNORECERTCNINVALID to WinINet, disabling hostname matching for HTTPS update metadata and crash-symbol requests while retaining certificate-chain validation. A network-positioned attacker with a Windows-trusted certificate for an attacker-controlled domain can impersonate the project's update host, inject promo text and a clickable URL before update metadata validation, and provide an attacker-controlled archive to ExtractSymbols(). Installer replacement is not directly possible because HttpGetToFile() validates TLS and MaybeStartUpdateDownload() restricts the download host. No fixed version is available as of this review.

Event History

Nov 4, 2026

CVE Published

via OSV·08:44 PM

Data Sourced

via OSV·08:44 PM

DescriptionSeverityWeakness

Frequently Asked Questions

Who is exposed to this issue?

Windows users running SumatraPDF 3.6.1 or earlier are affected when the application makes HTTPS requests through HttpGet(), including update-metadata and crash-symbol requests. Exploitation requires an attacker to be in a network position to intercept or influence the connection.

What does an attacker need to exploit it?

The attacker needs network position and a certificate trusted by Windows for a domain they control. Certificate-chain validation remains enabled, but hostname matching is disabled for the affected requests.

Can this be used to replace the SumatraPDF installer or deliver a malicious update installer?

Not directly through the described path. HttpGetToFile() validates TLS, and MaybeStartUpdateDownload() restricts the download host.

What can an attacker do through the affected requests?

An attacker can impersonate the update host to inject promotional text and a clickable URL before update metadata validation. They can also supply an attacker-controlled archive to ExtractSymbols().

What should organizations do if they cannot patch immediately?

No fixed version is available as of the review. Reduce exposure to hostile or untrusted network positions and treat unexpected update messaging, links, and crash-symbol activity as potentially untrusted.

GHSA-mjwr-9w29-jp96: SumatraPDF: TLS hostname validation disabled in `HttpGet()`

Event History

Frequently Asked Questions

Who is exposed to this issue?

What does an attacker need to exploit it?

Can this be used to replace the SumatraPDF installer or deliver a malicious update installer?

What can an attacker do through the affected requests?

What should organizations do if they cannot patch immediately?

Company

Resources

Contact

Frequently Asked Questions

Who is exposed to this issue?

What does an attacker need to exploit it?

Can this be used to replace the SumatraPDF installer or deliver a malicious update installer?

What can an attacker do through the affected requests?

What should organizations do if they cannot patch immediately?