SumatraPDF CVE-2026-107733

Exploitation requires: (1) a local attacker process in the SAME interactive Windows session, (2) running at an integrity level equal to or higher than SumatraPDF's (a Windows UIPI requirement to send it DDE or WM_COPYDATA messages), and (3) SumatraPDF being in its start-page state with NO document tab currently open - the null current-tab pointer only arises in that specific state. Limiting factors: there is no network vector (local only), the attacker must already have code execution at adequate integrity, and the sole impact is a crash with loss of unsaved state (no code execution, data disclosure, or persistence). No user interaction is needed, but the no-open-tab precondition narrows the exploitable window.

This is a genuine but low-urgency issue - a null pointer dereference denial of service, not a code-execution flaw. The supplied CVSS 4.0 vector (AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H) is internally consistent with the description: the only impact is availability (abrupt process termination), with no confidentiality or integrity effect, and the vector is explicitly local - an attacker must already be a process in the same interactive Windows session at an integrity level equal to or greater than SumatraPDF's (a UIPI requirement for sending DDE/WM_COPYDATA messages). No EPSS score, SSVC decision, or CISA KEV status is present in the input, and the vulnerability is not listed as actively exploited; absence of these is expected for a client-side DoS in a desktop reader and should not be read as either safe or dangerous. A public regression test shipped in the fix commit demonstrates the exact WM_COPYDATA/CmdExec trigger, so a working trigger is effectively public. Net: real but self-limited - an attacker who can already run code at adequate integrity in the user's session gains only the ability to crash the reader and destroy unsaved state, which is a low-value primitive. Note the conflict worth flagging: there is NO fixed version yet (only a source commit), so defenders cannot remediate by upgrading at time of analysis.

On a shared or multi-process Windows desktop, a malicious or compromised local process running at the same integrity level as SumatraPDF sends a crafted '[CmdExec "..."]' command over DDE or WM_COPYDATA while SumatraPDF is showing its start page with no document tab open. FrameOnCommand() passes the null current-tab pointer into RunWithExe(), which dereferences WindowTab::filePath, crashing the application and discarding any unsaved state. A public regression test in the fix commit demonstrates this trigger exactly.