Product by Sumatrapdfreader
Sumatrapdf
26 known vulnerabilities in Sumatrapdf (Sumatrapdfreader), 0 of them actively exploited (CISA KEV).
Key figures
26
Vulnerabilities
0
Actively exploited (KEV)
0
Used by ransomware
0
Critical
Vulnerabilities
Actively exploited vulnerabilities (CISA KEV) first, then by priority. Click a column header to re-sort the table.
| High | CVE-2012-5340 | Artifex MuPDF: Integer Overflow | 7.8 | |
| High | CVE-2013-2830 | Sumatrapdf: Use-After-Free | 7.8 | |
| Medium | CVE-2009-1605 | Sumatrapdf: Heap-Based Buffer Overflow | 5.4 | |
| High | CVE-2026-107732 | SumatraPDF: Markup/command-link injection into UI notification text | — | |
| Not rated | CVE-2009-4117 | Sumatrapdf: Stack-Based Buffer Overflow | — | |
| Not rated | CVE-2012-4896 | Sumatrapdf: Heap-Based Buffer Overflow | — | |
| Not rated | CVE-2012-4895 | Sumatrapdf: Heap-Based Buffer Overflow | — | |
| High | CVE-2026-107734 | Sumatrapdf: Argument Injection | — | |
| High | CVE-2026-107802 | SumatraPDF — Windows command-line argument injection in AI selection-translate | — | |
| Medium | CVE-2026-107733 | SumatraPDF: Null-pointer dereference in `CmdExec` when no document tab is open | — | |
| Medium | CVE-2026-107738 | SumatraPDF: Untrusted binary record offset used without lower-bound validation | — | |
| Medium | CVE-2026-107736 | SumatraPDF: stack buffer overflow while processing EXIF Orientation metadata | — | |
| High | CVE-2026-25961 | SumatraPDF Update MITM -> Arbitrary Code Execution | 7.5 | |
| Medium | CVE-2026-26054 | Sumatrapdf: Out-of-bounds Read | — | |
| Medium | CVE-2026-107737 | SumatraPDF CHM `its://` signed index causes an out-of-bounds object lookup | — | |
| High | CVE-2026-23512 | SumatraPDF has an Untrusted Search Path in sumatrapdf/src/AppTools.cpp | 8.6 | |
| Medium | CVE-2026-107729 | Sumatrapdf: Out-of-bounds Read | 5.5 | |
| Medium | CVE-2026-107730 | SumatraPDF: Signed integer overflow in the LIT header parsing causes invalid-pointer read | 5.5 | |
| Medium | CVE-2026-107731 | SumatraPDF: LIT parser range-validation flaws cause invalid-pointer reads and denial of service | 5.5 | |
| Medium | CVE-2026-107735 | SumatraPDF: `sumatrapdfrestrict.ini` never revokes any permission (fail-open policy initialization) | — | |
| Medium | CVE-2026-55586 | Sumatrapdf: Out-of-bounds Write | 6.6 | |
| High | CVE-2026-25880 | Untrusted Search Path in SumatraPDF Reader (explorer.exe on Windows) | 7.8 | |
| High | CVE-2025-57248 | Sumatrapdf: NULL Pointer Dereference | 7.3 | |
| Medium | CVE-2026-25920 | SumatraPDF has a heap out-of-bounds read in MOBI HuffDic decompressor | 5.5 | |
| Medium | CVE-2026-23951 | SumatraPDF's Integer Underflow in PalmDbReader Leads to Crash | 5.5 |