SumatraPDF
CVE-2026-107734
HIGH
Severity by source
CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Local file-based vector (AV:L) requiring a configured editor, a crafted synctex, and victim-invoked inverse search (AC:H, UI:R); no privileges needed (PR:N); high impact only if the editor executes injected flags.
Primary rating from Vendor (GitHub_M).
CVSS VectorVendor: GitHub_M
Lifecycle Timeline
5DescriptionCVE.org
SumatraPDF is a multi-format reader for Windows. In 3.5.2 and earlier, an attacker-controlled SyncTeX source filename is substituted for the %f placeholder in an external editor command line without safe Windows argument quoting, and the resulting command line is passed to CreateProcessW(). A user with an external editor configured or auto-detected who opens a PDF with a crafted .synctex.gz file and invokes inverse search can inject command-line flags; the resulting impact depends on the target editor interpreting those flags and can include unintended editor actions or code execution through a malicious extension. No broader impact is claimed beyond the advisory-supported conditions. No fixed version is available as of this review.
Articles & Coverage 1
AnalysisAI
Command-line argument injection in SumatraPDF 3.5.2 and earlier lets an attacker-controlled SyncTeX source filename escape the quoting of an external editor's command template and inject arbitrary flags when a victim triggers inverse search. The attack is strictly conditional: it requires a PDF paired with a crafted sibling .synctex.gz file, a configured or auto-detected inverse-search editor, and a deliberate user action (double-clicking to jump to source) at a coordinate that maps to the malicious node. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
No credit card · 7-day full trial
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires ALL of the following concrete prerequisites, per the advisory: (1) the victim must have an external inverse-search editor configured in SumatraPDF or auto-detected; (2) the attacker must supply both a PDF and a sibling .synctex.gz file (named <pdf-basename>.synctex.gz) containing a SyncTeX Input source filename carrying a quote-breakout payload such as foo.tex" --install-extension evil.vsix --; and (3) the victim must open that PDF and actively invoke inverse search (e.g. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | This is a moderate, conditional risk rather than a drop-everything priority. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | No vendor-released fixed version is confirmed as of this review - the affected range is 3.5.2 and earlier and no patched release number is given - but an upstream fix is available in commit 398d23624362c60722d9709173a287ea53545b3b, so users should track the advisory at https://github.com/sumatrapdfreader/sumatrapdf/security/advisories/GHSA-jf4v-rw66-j4w2 and upgrade as soon as a build containing that commit is published; the fix rejects SyncTeX source names containing " < > | CR LF TAB and doubles embedded double quotes in the editor command line. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, identify all endpoints running SumatraPDF 3.5.2 or earlier via software inventory or EDR telemetry, and instruct users not to open PDF files that arrive bundled with a sibling .synctex.gz file from untrusted sources; where inverse search is not business-required, have administrators disable or clear the configured external editor command in SumatraPDF so the vulnerable code path cannot be triggered. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Unauthenticated remote code execution in SmarterTools SmarterMail lets an attacker upload arbitrary files to any locatio
Windows Win32k fails to properly handle objects in memory, allowing local privilege escalation exploited in the wild in
A privilege escalation vulnerability (CVSS 5.5). Risk factors: actively exploited (KEV-listed), EPSS 94% exploitation pr
Windows Internet Shortcut Files (.url) contain an external control vulnerability (CVE-2025-33053, CVSS 8.8) that enables
Windows SMB contains an improper access control vulnerability (CVE-2025-33073, CVSS 8.8) enabling authenticated attacker
Twonky Server 8.5.2 on Linux and Windows allows unauthenticated access to the admin log file through a web service API b
An unrestricted file upload vulnerability exists in MiniWeb HTTP Server <= Build 300 that allows unauthenticated remote
FreeFloat FTP Server contains multiple critical design flaws that allow unauthenticated remote attackers to upload arbit
Serviio Media Server versions 1.4 through 1.8 on Windows contain an unauthenticated command injection in the /rest/actio
Twonky Server 8.5.2 uses hard-coded cryptographic keys for encrypting the administrator password. Combined with the cred
Mako Server versions 2.5 and 2.6 contain an unauthenticated OS command injection via the tutorial interface at examples/
React Native Metro Development Server binds to external interfaces by default and contains an OS command injection endpo
Same weakness CWE-20 – Improper Input Validation
View allShare
External POC / Exploit Code
Leaving vuln.today