PT-2026-2956 · Unknown · Sumatrapdf

Mariorl0 · Publicado 2026-01-14 · Atualizado 2026-01-15 · CVE-2026-23512

Positive Technologies (AI Summary)

CVSS v3.1

8.6

Alta

Vetor base

AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions SumatraPDF versions 3.5.2 and earlier

Description SumatraPDF is a multi-format reader for Windows. A flaw exists due to an Untrusted Search Path when the Advanced Options setting is triggered. The application executes notepad.exe without specifying an absolute path when using the Advanced Options setting. This allows execution of a malicious notepad.exe placed in the application's installation directory, potentially leading to arbitrary code execution.

Recommendations Versions prior to 3.5.3 are affected. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Untrusted Search Path

Enumeração de Fraquezas

CWE-426

Identificadores relacionados

BDU:2026-00586

CVE-2026-23512

GHSA-RQG5-GJ63-X4MV

Produtos afetados

Sumatrapdf

Referências · 11

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/23xxx/CVE-2026-23512.json · Exploit
• https://github.com/sumatrapdfreader/sumatrapdf/commit/2762e02a8cd7cb779c934a44257aac56ab7de673 · Nota
• https://github.com/sumatrapdfreader/sumatrapdf/security/advisories/GHSA-rqg5-gj63-x4mv · Nota
• https://twitter.com/VulmonFeeds/status/2011582567527469230 · Publicação no Twitter
• https://nvd.nist.gov/vuln/detail/CVE-2026-23512 · Nota de Segurança
• https://twitter.com/pulsepatchio/status/2011809629626384618 · Publicação no Twitter
• https://twitter.com/CveFindCom/status/2011553726260035684 · Publicação no Twitter
• https://twitter.com/CVEnew/status/2011555136800506018 · Publicação no Twitter
• https://twitter.com/TheHackerWire/status/2011548916991607016 · Publicação no Twitter
• https://osv.dev/vulnerability/CVE-2026-23512 · Aviso do Fabricante
• https://bdu.fstec.ru/vul/2026-00586 · Nota de Segurança