CVE-2026-25880

HighCVSS 7.8/10Last modified Jun 17, 2026

Description

SumatraPDF is a multi-format reader for Windows. In 3.5.2 and earlier, the PDF reader allows execution of a malicious binary (explorer.exe) located in the same directory as the opened PDF when the user clicks File → “Show in folder”. This behavior leads to arbitrary code execution on the victim’s system with the privileges of the current user, without any warning or user interaction beyond the menu click.

Metrics

CVSS 3.1 7.8/10CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-426

Affected software

Vendor	Product	Versions
sumatrapdfreader	sumatrapdf	<= 3.5.2

References

https://github.com/sumatrapdfreader/sumatrapdf/security/advisories/GHSA-5x4h-247q-px37Exploit, Vendor Advisory

Timeline

Published: Feb 9, 2026
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2026

CVE-2026-2588110.0SandboxJS is a JavaScript sandboxing library. Prior to 0.8.31, a sandbox escape vulnerability allows sandboxed code to mutate host built-in CVE-2026-258827.5Fiber is an Express inspired web framework written in Go. A denial of service vulnerability exists in Fiber v2 and v3 that allows remote att CVE-2026-258835.8Vexa is an open-source, self-hostable meeting bot API and meeting transcription API. Prior to 0.10.0-260419-1910, the Vexa webhook feature a CVE-2026-258848.1Exiv2 is a C++ library and a command-line utility to read, write, delete and modify Exif, IPTC, XMP and ICC image metadata. Prior to version CVE-2026-258857.5PolarLearn is a free and open-source learning program. In 0-PRERELEASE-16 and earlier, the group chat WebSocket at wss://polarlearn.nl/api/v CVE-2026-258877.2Chartbrew is an open-source web application that can connect directly to databases and APIs and use the data to create charts. Prior to vers CVE-2026-258888.8Chartbrew is an open-source web application that can connect directly to databases and APIs and use the data to create charts. Prior to vers CVE-2026-258895.4File Browser provides a file managing interface within a specified directory and it can be used to upload, delete, preview, rename and edit CVE-2026-25895.3The Greenshift – animation and page builder blocks plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up t CVE-2026-258908.1File Browser provides a file managing interface within a specified directory and it can be used to upload, delete, preview, rename and edit CVE-2026-258917.5Fiber is an Express inspired web framework written in Go. A Path Traversal (CWE-22) vulnerability in Fiber allows a remote attacker to bypas CVE-2026-258927.5Adminer is open-source database management software. Adminer v5.4.1 and earlier has a version check mechanism where adminer.org sends signed