CVE-2026-23512 SumatraPDF has an Untrusted Search Path in sumatrapdf/src/AppTools.cpp

High 8.6 Published 14 Jan 2026 Updated 14 Jan 2026

Attackers can execute arbitrary code by placing a malicious notepad.exe in the installation directory when Advanced Options are used.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Local or same network only
Victim action needed: A user has to click or open something
Fix: None listed

What is CVE-2026-23512?

CVE-2026-23512 is a high-severity vulnerability in sumatrapdfreader sumatrapdf, published on 14 Jan 2026. It can only be exploited from the same machine or local network, and only if a user opens a file or follows a link.

Official description

SumatraPDF is a multi-format reader for Windows. In 3.5.2 and earlier, there is a Untrusted Search Path vulnerability when Advanced Options setting is trigger. The application executes notepad.exe without specifying an absolute path when using the Advanced Options setting. On Windows, this allows execution of a malicious notepad.exe placed in the application's installation directory, leading to arbitrary code execution.

Weakness: CWE-426

Which versions are affected by CVE-2026-23512?

It affects 1 product.

Products include Sumatrapdfreader Sumatrapdf.

How do I fix CVE-2026-23512?

No fix has been published for CVE-2026-23512 yet. Limit exposure of the affected software until one is available.

Is CVE-2026-23512 being exploited?

It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-23512 exists.

Sources

Also known as GHSA-rqg5-gj63-x4mv.