{"id":"CVE-2026-115758","title":"SumatraPDF: TLS hostname validation disabled in `HttpGet()`","summary":"SumatraPDF is a multi-format reader for Windows. In version 3.6.1 and earlier, HttpGet() in src/base/Http_win.cpp unconditionally passes INTERNET_FLAG_IGNORE_CERT_CN_INVALID to WinINet, disabling hostname matching for HTTPS update metada…","severity":"high","cvss":8.2,"cvssVector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N","cvssSource":"cna","cwe":["CWE-297"],"vendor":"sumatrapdfreader","product":"sumatrapdf","affected":["sumatrapdf <= 3.6.1"],"published":"2026-11-04","updated":"2026-11-04","sourceUpdated":"2026-11-04T20:44:55.316Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-115758","references":[{"url":"https://github.com/sumatrapdfreader/sumatrapdf/security/advisories/GHSA-mjwr-9w29-jp96","label":"https://github.com/sumatrapdfreader/sumatrapdf/security/advisories/GHSA-mjwr-9w29-jp96"},{"url":"https://github.com/sumatrapdfreader/sumatrapdf/commit/bd30134175e897dd5ed0d7fd14acce52eeca7183","label":"https://github.com/sumatrapdfreader/sumatrapdf/commit/bd30134175e897dd5ed0d7fd14acce52eeca7183"}],"tags":["cve.org"],"ingestedAt":"2026-11-05T21:36:00.571Z","epss":0.00145,"epssPercentile":0.03792,"slug":"CVE-2026-115758","body":"## Overview\n\nSumatraPDF is a multi-format reader for Windows. In version 3.6.1 and earlier, HttpGet() in src/base/Http_win.cpp unconditionally passes INTERNET_FLAG_IGNORE_CERT_CN_INVALID to WinINet, disabling hostname matching for HTTPS update metadata and crash-symbol requests while retaining certificate-chain validation. A network-positioned attacker with a Windows-trusted certificate for an attacker-controlled domain can impersonate the project's update host, inject promo text and a clickable URL before update metadata validation, and provide an attacker-controlled archive to ExtractSymbols(). Installer replacement is not directly possible because HttpGetToFile() validates TLS and MaybeStartUpdateDownload() restricts the download host. No fixed version is available as of this review.\n\n## Affected\n\n- `sumatrapdf <= 3.6.1`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"twilight","depthScore":45,"depthScoreParts":{"impact":45.1,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}