High · published February 9, 2026
⚡ Just a menu click in SumatraPDF could let attackers run any executable they want! 🤯 Think of it like a restaurant where the waiter not only serves you your food but also delivers a hidden dish that nobody asked for. Clicking 'Show in folder' can lead to unexpected—and unwanted—courses running on your computer! An attacker could execute arbitrary code with the same privileges as the current user, potentially gaining full control over the system. This means they could access sensitive files, install malware, or even launch further attacks without raising any alarms. The consequences could be absolutely devastating!
Think of it like a restaurant where the waiter not only serves you your food but also delivers a hidden dish that nobody asked for. Clicking 'Show in folder' can lead to unexpected—and unwanted—courses running on your computer! In versions 3.5.2 and earlier of SumatraPDF, selecting 'Show in folder' allows execution of a malicious binary (like explorer.exe) that exists in the same directory as the opened PDF. This occurs without any user interaction or warning, leading to arbitrary code execution.
An attacker could execute arbitrary code with the same privileges as the current user, potentially gaining full control over the system. This means they could access sensitive files, install malware, or even launch further attacks without raising any alarms. The consequences could be absolutely devastating! To protect yourself, upgrade to version 3.5.3 or later immediately. Additionally, refrain from opening untrusted PDF files and review your directory contents regularly for suspicious files. 🛡️ You've got this! By taking these steps, you're reinforcing your defenses and turning into a security hero! 🦸♂️