# sumatrapdf.

Every CVE that names sumatrapdf among its affected products, newest first. Vendors and products are as the CNA wrote them.

## Records, newest first

- [SumatraPDF: TLS hostname validation disabled in \`HttpGet()\`](https://agentprime.io/advisories/CVE-2026-115758.md)
  `CVE-2026-115758` · CVE record: sumatrapdfreader sumatrapdf · CVSS 8.2 High · Not analysed yet · Published 4 Nov 2026 · Tags: Weak cryptography or TLS
- [SumatraPDF — Windows command-line argument injection in AI selection-translate](https://agentprime.io/advisories/CVE-2026-107802.md)
  `CVE-2026-107802` · CVE record: sumatrapdfreader sumatrapdf · CVSS 7.1 High · Not analysed yet · Published 8 Oct 2026 · Tags: Command injection
- [SumatraPDF: Untrusted binary record offset used without lower-bound validation](https://agentprime.io/advisories/CVE-2026-107738.md)
  `CVE-2026-107738` · CVE record: sumatrapdfreader sumatrapdf · CVSS 6.8 Medium · Not analysed yet · Published 8 Oct 2026 · Tags: Memory corruption
- [SumatraPDF CHM \`its://\` signed index causes an out-of-bounds object lookup](https://agentprime.io/advisories/CVE-2026-107737.md)
  `CVE-2026-107737` · CVE record: sumatrapdfreader sumatrapdf · CVSS 5.7 Medium · Not analysed yet · Published 8 Oct 2026 · Tags: CWE-129
- [SumatraPDF: stack buffer overflow while processing EXIF Orientation metadata](https://agentprime.io/advisories/CVE-2026-107736.md)
  `CVE-2026-107736` · CVE record: sumatrapdfreader sumatrapdf · CVSS 6.8 Medium · Not analysed yet · Published 8 Oct 2026 · Tags: Memory corruption
- [SumatraPDF: \`sumatrapdfrestrict.ini\` never revokes any permission (fail-open policy initialization)](https://agentprime.io/advisories/CVE-2026-107735.md)
  `CVE-2026-107735` · CVE record: sumatrapdfreader sumatrapdf · CVSS 5.4 Medium · Not analysed yet · Published 8 Oct 2026 · Tags: CWE-636
- [SumatraPDF: SyncTeX Argument Injection in Inverse Search Enables Arbitrary Command Execution via External Editors](https://agentprime.io/advisories/CVE-2026-107734.md)
  `CVE-2026-107734` · CVE record: sumatrapdfreader sumatrapdf · CVSS 7.1 High · Not analysed yet · Published 8 Oct 2026 · Tags: Command injection, CWE-20
- [SumatraPDF: Null-pointer dereference in \`CmdExec\` when no document tab is open](https://agentprime.io/advisories/CVE-2026-107733.md)
  `CVE-2026-107733` · CVE record: sumatrapdfreader sumatrapdf · CVSS 6.8 Medium · Not analysed yet · Published 8 Oct 2026 · Tags: Memory corruption
- [SumatraPDF: Markup/command-link injection into UI notification text](https://agentprime.io/advisories/CVE-2026-107732.md)
  `CVE-2026-107732` · CVE record: sumatrapdfreader sumatrapdf · CVSS 8.4 High · Not analysed yet · Published 8 Oct 2026 · Tags: Code injection
- [SumatraPDF: LIT parser range-validation flaws cause invalid-pointer reads and denial of service](https://agentprime.io/advisories/CVE-2026-107731.md)
  `CVE-2026-107731` · CVE record: sumatrapdfreader sumatrapdf · CVSS 5.5 Medium · Not analysed yet · Published 8 Oct 2026 · Tags: Memory corruption
- [SumatraPDF: Signed integer overflow in the LIT header parsing causes invalid-pointer read](https://agentprime.io/advisories/CVE-2026-107730.md)
  `CVE-2026-107730` · CVE record: sumatrapdfreader sumatrapdf · CVSS 5.5 Medium · Not analysed yet · Published 8 Oct 2026 · Tags: Memory corruption
- [SumatraPDF: Unsigned-to-signed hdrLen validation bypass in SumatraPDF MOBI parsing causes out-of-bounds read](https://agentprime.io/advisories/CVE-2026-107729.md)
  `CVE-2026-107729` · CVE record: sumatrapdfreader sumatrapdf · CVSS 5.5 Medium · Not analysed yet · Published 8 Oct 2026 · Tags: Memory corruption
- [SumatraPDF: Heap out-of-bounds read in MOBI header parser.](https://agentprime.io/advisories/CVE-2026-26054.md)
  `CVE-2026-26054` · CVE record: sumatrapdfreader sumatrapdf · CVSS 6.8 Medium · Not analysed yet · Published 24 Sept 2026 · Tags: Memory corruption
- [SumatraPDF: Heap out-of-bounds write in vendored CHMLib LZX Huffman table construction reachable from crafted CHM files](https://agentprime.io/advisories/CVE-2026-55586.md)
  `CVE-2026-55586` · CVE record: sumatrapdfreader sumatrapdf · CVSS 6.6 Medium · Not analysed yet · Published 20 Aug 2026 · Tags: Memory corruption
- [SumatraPDF Update MITM -> Arbitrary Code Execution](https://agentprime.io/advisories/CVE-2026-25961.md)
  `CVE-2026-25961` · CVE record: sumatrapdfreader sumatrapdf · CVSS 7.5 High · Not analysed yet · Published 9 Feb 2026 · Tags: Weak cryptography or TLS, CWE-494
- [SumatraPDF has a heap out-of-bounds read in MOBI HuffDic decompressor](https://agentprime.io/advisories/CVE-2026-25920.md)
  `CVE-2026-25920` · CVE record: sumatrapdfreader sumatrapdf · CVSS 5.5 Medium · Not analysed yet · Published 9 Feb 2026 · Tags: Memory corruption
- [Untrusted Search Path in SumatraPDF Reader (explorer.exe on Windows)](https://agentprime.io/advisories/CVE-2026-25880.md)
  `CVE-2026-25880` · CVE record: sumatrapdfreader sumatrapdf · CVSS 7.8 High · Not analysed yet · Published 9 Feb 2026 · Tags: CWE-426
- [SumatraPDF's Integer Underflow in PalmDbReader Leads to Crash](https://agentprime.io/advisories/CVE-2026-23951.md)
  `CVE-2026-23951` · CVE record: sumatrapdfreader sumatrapdf · CVSS 5.5 Medium · Not analysed yet · Published 22 Jan 2026 · Tags: Memory corruption
- [SumatraPDF has an Untrusted Search Path in sumatrapdf/src/AppTools.cpp](https://agentprime.io/advisories/CVE-2026-23512.md)
  `CVE-2026-23512` · CVE record: sumatrapdfreader sumatrapdf · CVSS 8.6 High · Not analysed yet · Published 14 Jan 2026 · Tags: CWE-426

## Filters and formats

Filters are query parameters on this URL: `q` (words, as in a web search engine: `"a phrase"`, `OR`, `-word`; an id; a package or product name), `severity` (low, medium, high or critical), `critical=1`, `kev=1`, `ecosystem` (npm, pypi, packagist, go, maven, rubygems, crates, nuget, hex), `kind=package`, `assigner` (a CNA’s short name), `min_score` and `state`. Each record’s title links to its Markdown page.

- The same list as JSON: <https://api.agentprime.io/v1/advisories?technology=sumatrapdf>
- Every list: <https://agentprime.io/advisories.md>, critical: <https://agentprime.io/advisories/critical.md>; by weakness: <https://agentprime.io/advisories/tag/sql-injection.md> and the other tags in <https://agentprime.io/llms.txt>; by technology: `/advisories/technology/<slug>.md` (`fortinet-fortimail`)

---

The web page: <https://agentprime.io/advisories/technology/sumatrapdf/>. Everything for agents: <https://agentprime.io/llms.txt>.