CVE-2026-107735 in SumatraPDF
Summary
by MITRE • 10/09/2026
SumatraPDF is a multi-format reader for Windows. In 3.6.1 and earlier, InitializePolicies() starts the sumatrapdfrestrict.ini path with gPolicyRestrictions set to Perm::All and only ORs permission bits, so the INI file never revokes permissions. Deploying SumatraPDF with this INI file, including a malformed file or zero-valued permission settings, can silently bypass configured disk, network, printing, registry, clipboard, preference, and fullscreen restrictions. The -restrict command-line path works correctly and is not affected. No fixed version is available as of this review.
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 10/09/2026
SumatraPDF serves as a widely utilized multi-format document viewer for the Windows operating system, supporting various file types including PDF, EPUB, CBZ, and CHM. A critical security flaw exists within versions 3.6.1 and earlier regarding the initialization of policy restrictions through the sumatrapdfrestrict.ini configuration file. This vulnerability stems from a logic error in the InitializePolicies function, which is responsible for parsing and applying security constraints defined by administrators or users to limit application capabilities such as disk access, network connectivity, printing, registry modifications, clipboard operations, preference changes, and fullscreen mode activation.
The core technical flaw lies in how permission bits are processed during initialization. The code initializes the gPolicyRestrictions variable with a default state of Perm::All, which effectively grants unrestricted access to all protected resources. Subsequently, when parsing the INI file, the application only performs bitwise OR operations on these permissions rather than using logical AND or explicit revocation mechanisms. Because the initial state is already permissive, any subsequent permission bits read from the configuration file are merely added to this existing set of allowed actions. Consequently, it becomes impossible for the INI file to revoke specific permissions that were implicitly granted by the default initialization value. This design oversight means that even if an administrator attempts to restrict certain functionalities via the configuration file, those restrictions will be silently ignored because the base permission level remains all-encompassing.
This architectural defect leads to a significant operational impact where security controls intended to mitigate risk are rendered ineffective. Deploying SumatraPDF with this specific INI file, whether intentionally configured or inadvertently malformed, results in a silent bypass of critical security boundaries. Attackers who can influence the configuration environment or exploit other vulnerabilities that allow them to manipulate application state may find that restrictions on disk I/O, network access, printing capabilities, registry edits, clipboard usage, and fullscreen mode are not enforced. This lack of enforcement undermines defense-in-depth strategies, particularly in environments where SumatraPDF is deployed with strict security policies to prevent data exfiltration or unauthorized system modifications. The vulnerability effectively nullifies the intended purpose of the restriction mechanism, leaving systems exposed to potential abuse through these unchecked vectors.
It is important to note that this specific logic error does not affect command-line usage involving the -restrict flag. When invoked via the command line with explicit restrictions, SumatraPDF correctly applies those limitations without falling into the permissive initialization trap described above. This distinction highlights that the flaw is isolated to the configuration file parsing routine rather than a fundamental issue with all restriction mechanisms within the software. As of the time of this analysis, no fixed version has been released by the vendor to address this persistent logic error in the INI-based policy application process.
From an industry standard perspective, this vulnerability aligns with CWE-20 Improper Input Validation and CWE-754 Incorrect Check or Condition for Special Element, as the software fails to correctly validate and apply security constraints based on input configuration data. In terms of attack patterns, this relates to MITRE ATT&CK techniques involving privilege escalation or defense evasion through misconfiguration exploitation, specifically where an attacker relies on default-permissive states to bypass intended restrictions. Organizations relying on SumatraPDF for secure document viewing in restricted environments should be aware that the INI-based restriction mechanism is currently unreliable due to this flaw. Mitigation strategies must rely heavily on external controls such as application whitelisting, strict file integrity monitoring of configuration files, and limiting user privileges at the operating system level rather than depending solely on SumatraPDF's internal policy engine until a patched version becomes available.