SumatraPDF’s update system, between versions 3.5.0 and 3.5.2, turns off TLS hostname verification and installs software without verifying signatures. This creates a pathway for an attacker to serve a malicious installer during a routine update check, allowing them to run arbitrary code on the target machine. The vulnerability is a classic example of certificate validation failure combined with missing signature verification; the result is a full compromise of the victim system.

The affected product is SumatraPDF Reader, versions 3.5.0 through 3.5.2, used on Windows platforms. No other vendors or products are listed.

The CVSS score of 7.5 marks the flaw as high severity, while the EPSS score of less than 1% indicates a low likelihood of exploitation at present. The vulnerability is not identified in the CISA KEV catalog, suggesting no documented public exploitation. The attack proceeds over the network: a malicious actor intercepts the HTTPS update request, substitutes a malicious installer URL, and gains code execution. This requires network presence and control of the TLS certificate chain, which can be obtained with a legitimate certificate such as Let’s Encrypt. Although rare, the potential impact is complete loss of system integrity.