Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%

sumatrapdf — Vulnerabilities & Security Advisories 18

All 18 CVE vulnerabilities found in sumatrapdf, with AI-generated Chinese analysis, references, and POCs.

This page documents vulnerability aggregation data for SumatraPDF, a lightweight PDF reader, focusing on Common Vulnerabilities and Exposures related to its software distribution. The collection includes various security issues such as buffer overflows, out-of-bounds reads, and improper input validation discovered in different versions of the application. It covers vulnerabilities identified from the initial public release through recent updates, ensuring a comprehensive historical view of the software's security landscape. Here, users can track vendor advisories from the official SumatraPDF project, analyze trends within specific weakness classes like memory corruption or parsing errors, and look up the complete vulnerability history for this specific product. This resource is designed for security professionals, developers, and users who need to understand the risk profile of SumatraPDF over time. By aggregating these findings, the page provides context on how specific flaws were addressed, which versions are affected, and the general maturity of the software's security practices. It serves as a reference for assessing the current state of the application and making informed decisions about upgrades or mitigations. The data is organized to facilitate easy searching and comparison, allowing stakeholders to quickly identify critical issues without navigating through multiple external sources. This centralized view helps in maintaining awareness of potential threats and understanding the evolution of security patches within the SumatraPDF ecosystem.

Vendor: sumatrapdfreader

CVE ID Title CVSS Severity Published
CVE-2026-107802 SumatraPDF — Windows command-line argument injection in AI selection-translate CWE-88 7.1 High 2026-10-08
CVE-2026-107738 SumatraPDF: Untrusted binary record offset used without lower-bound validation CWE-125 6.8 Medium 2026-10-08
CVE-2026-107737 SumatraPDF CHM `its://` signed index causes an out-of-bounds object lookup CWE-129 5.7 Medium 2026-10-08
CVE-2026-107736 SumatraPDF: stack buffer overflow while processing EXIF Orientation metadata CWE-121 6.8 Medium 2026-10-08
CVE-2026-107735 SumatraPDF: `sumatrapdfrestrict.ini` never revokes any permission (fail-open policy initialization) CWE-636 5.4 Medium 2026-10-08
CVE-2026-107734 SumatraPDF: SyncTeX Argument Injection in Inverse Search Enables Arbitrary Command Execution via External Editors CWE-20 7.1 High 2026-10-08
CVE-2026-107733 SumatraPDF: Null-pointer dereference in `CmdExec` when no document tab is open CWE-476 6.8 Medium 2026-10-08
CVE-2026-107732 SumatraPDF: Markup/command-link injection into UI notification text CWE-94 8.4 High 2026-10-08
CVE-2026-107731 SumatraPDF: LIT parser range-validation flaws cause invalid-pointer reads and denial of service CWE-125 5.5 Medium 2026-10-08
CVE-2026-107730 SumatraPDF: Signed integer overflow in the LIT header parsing causes invalid-pointer read CWE-190 5.5 Medium 2026-10-08
CVE-2026-107729 SumatraPDF: Unsigned-to-signed hdrLen validation bypass in SumatraPDF MOBI parsing causes out-of-bounds read CWE-125 5.5 Medium 2026-10-08
CVE-2026-26054 SumatraPDF: Heap out-of-bounds read in MOBI header parser. CWE-125 6.8 Medium 2026-09-24
CVE-2026-55586 SumatraPDF: Heap out-of-bounds write in vendored CHMLib LZX Huffman table construction reachable from crafted CHM files CWE-119 6.6 Medium 2026-08-20
CVE-2026-25961 SumatraPDF Update MITM -> Arbitrary Code Execution CWE-295 7.5 High 2026-02-09
CVE-2026-25920 SumatraPDF has a heap out-of-bounds read in MOBI HuffDic decompressor CWE-125 5.5 Medium 2026-02-09
CVE-2026-25880 Untrusted Search Path in SumatraPDF Reader (explorer.exe on Windows) CWE-426 7.8 High 2026-02-09
CVE-2026-23951 SumatraPDF's Integer Underflow in PalmDbReader Leads to Crash CWE-125 5.5 Medium 2026-01-22
CVE-2026-23512 SumatraPDF has an Untrusted Search Path in sumatrapdf/src/AppTools.cpp CWE-426 8.6 High 2026-01-14

All 18 known CVE vulnerabilities affecting sumatrapdf with full Chinese analysis, references, and POCs where available.