CVE-2026-25880: SumatraPDF RCE Vulnerability

CVE-2026-25880 Overview

SumatraPDF is a popular multi-format document reader for Windows that supports PDF, EPUB, MOBI, XPS, and other formats. A critical vulnerability has been identified in SumatraPDF version 3.5.2 and earlier that allows arbitrary code execution through an Untrusted Search Path attack (CWE-426). When a user opens a PDF file and clicks File → "Show in folder", the application attempts to launch explorer.exe without specifying an absolute path. This behavior can be exploited by placing a malicious binary named explorer.exe in the same directory as the target PDF file, resulting in arbitrary code execution with the privileges of the current user.

Critical Impact
Attackers can achieve arbitrary code execution on victim systems by distributing a malicious explorer.exe alongside a seemingly benign PDF file. No additional user interaction beyond a single menu click is required.

Affected Products

SumatraPDF version 3.5.2 and earlier
Windows installations running vulnerable SumatraPDF versions

Discovery Timeline

2026-02-09 - CVE CVE-2026-25880 published to NVD
2026-02-10 - Last updated in NVD database

Technical Details for CVE-2026-25880

Vulnerability Analysis

This vulnerability is classified as CWE-426: Untrusted Search Path. When SumatraPDF processes the "Show in folder" menu action, it invokes explorer.exe to display the containing folder of the currently opened document. However, the application fails to use an absolute path when calling this system executable.

The Windows operating system follows a specific search order when locating executables. By default, the current working directory is searched before system directories. When a user opens a PDF file from an untrusted location (such as a downloaded archive or network share), the working directory becomes that location. An attacker can exploit this by placing a malicious executable named explorer.exe in the same directory as a crafted PDF file.

The attack requires local access in the sense that the malicious files must be placed on the victim's system, though this can be achieved through various delivery mechanisms such as email attachments, malicious downloads, or compromised network shares. The vulnerability requires user interaction—specifically, the victim must open the PDF and then click the "Show in folder" menu option.

Root Cause

The root cause of this vulnerability lies in the application's failure to specify an absolute path when invoking system executables. Instead of calling C:\Windows\explorer.exe explicitly, the application relies on the system's path resolution, which prioritizes the current working directory. This design flaw allows directory-adjacent malicious binaries to be executed in place of legitimate system utilities.

Attack Vector

The attack follows this sequence:

Attacker creates a malicious payload executable and names it explorer.exe
Attacker packages this malicious binary alongside a legitimate-looking PDF document
The victim extracts or downloads both files to the same directory
The victim opens the PDF file using SumatraPDF
When the victim clicks File → "Show in folder", SumatraPDF attempts to launch explorer.exe
Windows locates the malicious explorer.exe in the current directory before finding the legitimate system executable
The malicious code executes with the victim's user privileges

This attack is particularly dangerous because it requires minimal user interaction beyond normal document viewing behavior. The malicious payload could perform actions such as downloading additional malware, establishing persistence, stealing credentials, or encrypting files for ransomware purposes.

Detection Methods for CVE-2026-25880

Indicators of Compromise

Presence of explorer.exe files in non-system directories, particularly alongside PDF documents
Process execution events showing explorer.exe launching from unusual paths (not C:\Windows\explorer.exe)
SumatraPDF spawning child processes from document directories rather than system paths

Detection Strategies

Monitor for explorer.exe execution from paths outside C:\Windows\ and C:\Windows\SysWOW64\
Implement file integrity monitoring to detect suspicious executables placed alongside document files
Use endpoint detection and response (EDR) solutions to track process parent-child relationships, specifically SumatraPDF spawning unexpected executables
Create alerts for any process named explorer.exe that has an unusual image path hash

Monitoring Recommendations

Deploy SentinelOne agents to monitor for untrusted executable launches from document directories
Enable process creation auditing to track all child processes spawned by document readers
Implement application whitelisting policies to prevent execution of binaries from user-writable directories
Review downloaded archives and email attachments for suspicious executable content alongside documents

How to Mitigate CVE-2026-25880

Immediate Actions Required

Update SumatraPDF to the latest patched version when available from the vendor
Implement application control policies to block execution of unsigned binaries from user directories
Configure endpoint protection to quarantine suspicious executables found alongside document files
Educate users about the risks of opening documents from untrusted sources

Patch Information

Users should monitor the SumatraPDF GitHub Security Advisory for official patch releases. The fix should ensure that system executables like explorer.exe are invoked using absolute paths to prevent untrusted search path exploitation.

Workarounds

Avoid using the "Show in folder" functionality in SumatraPDF until a patch is applied
Always extract downloaded archives to trusted locations and verify no unexpected executable files are present
Use file explorer to navigate to document locations manually rather than relying on application-launched file browsers
Consider using alternative PDF readers until SumatraPDF releases a security update

bash

# PowerShell script to detect suspicious explorer.exe files outside system directories
Get-ChildItem -Path "C:\Users" -Recurse -Filter "explorer.exe" -ErrorAction SilentlyContinue | 
    Where-Object { $_.DirectoryName -notlike "*Windows*" } | 
    Select-Object FullName, LastWriteTime, Length