SumatraPDF, a Windows PDF reader, has an Untrusted Search Path flaw in its Advanced Options feature that causes the application to execute notepad.exe without a full path. If an attacker places a malicious notepad.exe in the installed folder, the program will run it, allowing the attacker to execute arbitrary code with the privileges of the user running SumatraPDF. The vulnerability originates from CWE-426 and results in unrestricted code execution for any user who launches the application with the Advanced Options enabled.

The issue affects SumatraPDF releases 3.5.2 and earlier on Windows operating systems. The product name is SumatraPDF by sumatrapdfreader, and the affected product is the sumatrapdf application. All installations of these older versions are susceptible when the Advanced Options setting is in use.

The vulnerability scores 8.6 on the CVSS scale, indicating high severity, and has an EPSS score of less than 1 %, suggesting a low but existing likelihood of exploitation. It is not listed in the CISA KEV catalog. The typical attack vector requires a user to open SumatraPDF with Advanced Options enabled after an attacker has placed a crafted notepad.exe in the program directory. Because the bug relies on a local search path, it does not require network exposure but still poses a critical risk to any user who runs the software on a compromised system.