SumatraPDF
CVE-2026-107732
HIGH
Severity by source
CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Local because a file must be opened locally (AV:L), link click required (UI:R), no auth (PR:N); arbitrary program execution in user context gives full C/I/A:H with no privilege-boundary crossing (S:U).
Primary rating from Vendor (GitHub_M).
CVSS VectorVendor: GitHub_M
Lifecycle Timeline
5DescriptionCVE.org
SumatraPDF is a multi-format reader for Windows. In 3.6.1 and earlier, untrusted document paths and PDF link targets are interpolated into notification text that ParseTip() interprets as trusted tip markup. When a user clicks an injected link, ExecuteTipLink() dispatches its CmdExec command and can execute an attacker-selected local program in the user's context. No broader impact is claimed beyond the advisory-supported conditions. No fixed version is available as of this review.
Articles & Coverage 1
AnalysisAI
Local code execution in SumatraPDF 3.6.1 and earlier on Windows is possible when a user opens an attacker-supplied document and then clicks a link inside a SumatraPDF notification popup, because untrusted text (the document path or a PDF link target) is fed into the notification renderer that interprets '(CmdFoo)' markup as a trusted command link. The injected link dispatches a CmdExec command through ExecuteTipLink(), letting the attacker run a chosen local program with the invoking user's own privileges - no elevation, but also no network exposure, since the malicious file must be opened locally and the injected link must be clicked (UI:R/UI:A, AV:L in both the vendor CVSS 4.0 score of 8.4 and our assessed CVSS 3.1 vector AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H). …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
No credit card · 7-day full trial
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires that the victim open an attacker-controlled document in SumatraPDF 3.6.1 or earlier, where the untrusted document file path or a PDF link target is interpolated into a notification tip that ParseTip() parses as trusted markup, AND that the victim then clicks the attacker-injected link, which causes ExecuteTipLink() to dispatch a CmdExec command. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | This is a genuine code-execution flaw (CWE-94) but its real-world risk is moderate rather than critical, and the signals are consistent once the attack vector is read correctly. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | No vendor-released patched version was identified at time of analysis; the only confirmed fix is upstream commit 8b680387ed69e3504ef296e09d6e032f81076af8, which must be built from source or awaited in a release after 3.6.1. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, inventory all instances of SumatraPDF, focusing on versions 3.6.1 and earlier, and instruct users to avoid opening untrusted PDFs or clicking links in SumatraPDF notification popups; if feasible, apply the upstream fix commit by building from source or temporarily disable the notification feature if configurable. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Unauthenticated remote code execution in SmarterTools SmarterMail lets an attacker upload arbitrary files to any locatio
Windows Win32k fails to properly handle objects in memory, allowing local privilege escalation exploited in the wild in
A privilege escalation vulnerability (CVSS 5.5). Risk factors: actively exploited (KEV-listed), EPSS 94% exploitation pr
Windows Internet Shortcut Files (.url) contain an external control vulnerability (CVE-2025-33053, CVSS 8.8) that enables
Windows SMB contains an improper access control vulnerability (CVE-2025-33073, CVSS 8.8) enabling authenticated attacker
Twonky Server 8.5.2 on Linux and Windows allows unauthenticated access to the admin log file through a web service API b
An unrestricted file upload vulnerability exists in MiniWeb HTTP Server <= Build 300 that allows unauthenticated remote
FreeFloat FTP Server contains multiple critical design flaws that allow unauthenticated remote attackers to upload arbit
Serviio Media Server versions 1.4 through 1.8 on Windows contain an unauthenticated command injection in the /rest/actio
Twonky Server 8.5.2 uses hard-coded cryptographic keys for encrypting the administrator password. Combined with the cred
Mako Server versions 2.5 and 2.6 contain an unauthenticated OS command injection via the tutorial interface at examples/
React Native Metro Development Server binds to external interfaces by default and contains an OS command injection endpo
Same weakness CWE-94 – Code Injection
View allShare
External POC / Exploit Code
Leaving vuln.today