# CVE-2026-115758: SumatraPDF TLS hostname validation bypass in HttpGet

Source: https://junglewise.ai/threats/cve-2026-115758-sumatrapdf-is-a-multi-format-reader-for-windows-in-version-3-6-1  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-11-04. Updated: 2026-11-04  
License: CC BY 4.0 with a link back

CVE-2026-115758 · Severity: info · Published 2026-11-04

SumatraPDF is a document reader for Windows that automatically checks for updates. The application disables SSL/TLS hostname verification, allowing a network attacker with any trusted certificate to intercept update checks and inject malicious promotional text or links directly into the application interface, or serve forged crash-symbol archives. Installer replacement is prevented by additional validation, but user data and experience are at risk.

Technologies: [SumatraPDF](https://junglewise.ai/threats/technologies/sumatrapdf). Vendors: [SumatraPDF](https://junglewise.ai/threats/vendors/sumatrapdf).

## Quick answers

**Is CVE-2026-115758 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-115758 being exploited in the wild.

**How severe is CVE-2026-115758?** Informational severity, published 4 November 2026.

**Which products and versions are affected?** SumatraPDF 3.6.1 and earlier.

**Is there a fix for CVE-2026-115758?** No fixed version is recorded yet. Restrict SumatraPDF's network access to trusted networks, or use a firewall rule to block outbound connections to sumatrapdfreader.org unless the update check is user-initiated and verified. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-115758 attacked?** It is attacked over the network or from the adjacent network, in a software library.

**Am I affected by CVE-2026-115758?** Check whether you run SumatraPDF at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix


Restrict SumatraPDF's network access to trusted networks, or use a firewall rule to block outbound connections to sumatrapdfreader.org unless the update check is user-initiated and verified.

## Technical details

HttpGet() in src/base/Http_win.cpp unconditionally sets INTERNET_FLAG_IGNORE_CERT_CN_INVALID, disabling hostname matching while retaining certificate-chain validation (CWE-297). A network-positioned attacker with a Windows-trusted certificate for an attacker-controlled domain can intercept HTTPS requests to the update-check and crash-symbol endpoints; parsed promo text is applied before validation gates, enabling injection of attacker-controlled URLs into the UI, and crash-symbol extraction processes untrusted archive data. The commit bd30134 removes the flag and adds user-facing error dialogs on manual update-check failures.

## Affected products

- SumatraPDF SumatraPDF 3.6.1 and earlier

## Timeline

- 2026-07-29: disclosed
- 2026-11-04: advisory

## References

- [https://github.com/sumatrapdfreader/sumatrapdf/commit/bd30134175e897dd5ed0d7fd14acce52eeca7183](https://github.com/sumatrapdfreader/sumatrapdf/commit/bd30134175e897dd5ed0d7fd14acce52eeca7183)
- [https://github.com/sumatrapdfreader/sumatrapdf/security/advisories/GHSA-mjwr-9w29-jp96](https://github.com/sumatrapdfreader/sumatrapdf/security/advisories/GHSA-mjwr-9w29-jp96)

## Related threats

- [SumatraPDF command-line argument injection in AI translation](https://junglewise.ai/threats/cve-2026-107802-sumatrapdf-is-a-multi-format-reader-for-windows-in-3-6-1-and)
- [SumatraPDF out-of-bounds read in CHM parser](https://junglewise.ai/threats/cve-2026-107738-sumatrapdf-is-a-multi-format-reader-for-windows-in-3-6-1-and)
- [SumatraPDF out-of-bounds pointer read in its:// window lookup](https://junglewise.ai/threats/cve-2026-107737-sumatrapdf-is-a-multi-format-reader-for-windows-in-3-6-1-and)
- [SumatraPDF stack buffer overflow in EXIF Orientation parsing](https://junglewise.ai/threats/cve-2026-107736-sumatrapdf-is-a-multi-format-reader-for-windows-in-3-6-1-and)
- [SumatraPDF restriction policy initialization fail-open](https://junglewise.ai/threats/cve-2026-107735-sumatrapdf-is-a-multi-format-reader-for-windows-in-3-6-1-and)