SU
Product
sumatrapdf
26
CVEs
0
On KEV
8.4
Max CVSS
11
New 30D
Severity mix
Critical 0High 9Medium 14Low 0
Watch
Add sumatrapdf to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2026-107732 | 8.4 | Oct 8 | SumatraPDF: Markup/command-link injection into UI notification text Affected: <= 3.6.1 |
| CVE-2026-25880 | 7.8 | Feb 9 | Untrusted Search Path in SumatraPDF Reader (explorer.exe on Windows) Affected: <= 3.5.2 |
| CVE-2026-23512 | 7.8 | Jan 14 | SumatraPDF has an Untrusted Search Path in sumatrapdf/src/AppTools.cpp Affected: <= 3.5.2 |
| CVE-2012-5340 | 7.8 | Jan 23 | SumatraPDF 2.1.1/MuPDF 1.0 allows remote attackers to cause an Integer Overflow in the lex_number() function via a corrupt PDF file Affected: 2.1.1 |
| CVE-2013-2830 | 7.8 | Feb 8 | Use-after-free vulnerability in SumatraPDF Reader 2.x before 2.2.1 allows remote attackers to execute arbitrary code via a crafted PDF file Affected: 2.0 before 2.2.1 |
| CVE-2026-25961 | 7.5 | Feb 9 | SumatraPDF Update MITM -> Arbitrary Code Execution Affected: >= 3.5.0, <= 3.5.2 |
| CVE-2025-57248 | 7.3 | Sep 15 | A null pointer dereference vulnerability was discovered in SumatraPDF 3.5.2 during the processing of a crafted .djvu file Affected: 3.5.2 |
| CVE-2026-107802 | 7.1 | Oct 8 | SumatraPDF — Windows command-line argument injection in AI selection-translate Affected: <= 3.6.1 |
| CVE-2026-107734 | 7.1 | Oct 8 | SumatraPDF: SyncTeX Argument Injection in Inverse Search Enables Arbitrary Command Execution via External Editors Affected: <= 3.5.2 |
Showing 9