1. Home
  2. CVE Database
  3. CVE-2026-23512
HIGH · 8.6

CVE-2026-23512

SumatraPDF is a multi-format reader for Windows. In 3.5.2 and earlier, there is a Untrusted Search Path vulnerability when Advanced Options setting is trigger. The application executes notepad.exe wit...

Vulnerability Description

SumatraPDF is a multi-format reader for Windows. In 3.5.2 and earlier, there is a Untrusted Search Path vulnerability when Advanced Options setting is trigger. The application executes notepad.exe without specifying an absolute path when using the Advanced Options setting. On Windows, this allows execution of a malicious notepad.exe placed in the application's installation directory, leading to arbitrary code execution.

CVSS Score

8.6

HIGH

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H
Attack Vector
LOCAL
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
REQUIRED
Scope
CHANGED
Confidentiality
HIGH
Integrity
HIGH
Availability
HIGH

Affected Products

VendorProductVersions
SumatrapdfreaderSumatrapdf<= 3.5.2
MicrosoftWindows-

Related Weaknesses (CWE)

CWE-426

References

FAQ

What is CVE-2026-23512?

CVE-2026-23512 is a vulnerability with a CVSS score of 8.6 (HIGH). SumatraPDF is a multi-format reader for Windows. In 3.5.2 and earlier, there is a Untrusted Search Path vulnerability when Advanced Options setting is trigger. The application executes notepad.exe wit...

How severe is CVE-2026-23512?

CVE-2026-23512 has been rated HIGH with a CVSS base score of 8.6/10. Review the CVSS metrics above for detailed severity breakdown.

Is there a patch for CVE-2026-23512?

Check the references section above for vendor advisories and patch information. Affected products include: Sumatrapdfreader Sumatrapdf, Microsoft Windows.