CVE-2026-107733 in SumatraPDF
Summary
by MITRE • 10/09/2026
SumatraPDF is a multi-format reader for Windows. In 3.6.1 and earlier, FrameOnCommand() handles CmdExec by passing a null current-tab pointer to RunWithExe(), which dereferences WindowTab::filePath. A local process in the same interactive Windows session, at an integrity level greater than or equal to SumatraPDF's under Windows UIPI, can dispatch CmdExec over DDE or WM_COPYDATA while no document tab is open, causing abrupt process termination and loss of unsaved state. No broader impact is claimed beyond the advisory-supported conditions. No fixed version is available as of this review.
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 10/09/2026
The vulnerability identified in SumatraPDF versions 3.6.1 and earlier represents a critical memory safety flaw rooted in improper null pointer handling within the application's command execution logic. Specifically, the FrameOnCommand function processes CmdExec commands by invoking RunWithExe without first verifying that the current tab object is valid. When no document tab is open, this results in passing a null pointer to functions that subsequently attempt to dereference WindowTab::filePath. This sequence of operations leads directly to an access violation or segmentation fault, causing the application process to terminate abruptly. The technical nature of this flaw aligns with CWE-476, which describes NULL Pointer Dereference vulnerabilities where software fails to check for null pointers before using them, leading to crashes and potential denial of service conditions.
From a threat modeling perspective, this vulnerability is exploitable by local processes operating within the same interactive Windows session that possess an integrity level equal to or greater than that of SumatraPDF under User Interface Privilege Isolation constraints. Attackers can leverage Dynamic Data Exchange mechanisms or WM_COPYDATA messages to inject malicious CmdExec commands into the application when no tab is active. This specific attack vector highlights a failure in input validation and state management, as the application does not adequately guard against command execution requests during an invalid operational state where no document context exists. The ability for local processes to trigger this condition underscores risks associated with CWE-20 Improper Input Validation, particularly regarding how applications handle external inputs that manipulate internal control flow based on transient UI states.
The operational impact of this vulnerability is primarily a denial of service characterized by the abrupt termination of the SumatraPDF process. Users experience immediate loss of unsaved state and disruption of workflow due to the unexpected crash. While the advisory suggests no broader security implications such as arbitrary code execution or privilege escalation, the reliability issues pose significant risks in environments where application stability is paramount. The lack of a fixed version as of this review indicates that users must rely on mitigations rather than patches. Mitigation strategies should focus on restricting local inter-process communication channels to trusted applications only and ensuring that SumatraPDF runs with appropriate integrity levels to minimize the attack surface for lower-privilege processes attempting to exploit UIPI boundaries. Additionally, monitoring for abnormal process termination events can aid in detecting potential exploitation attempts in real-time environments.