SumatraPDF CVE-2026-107735

Exploitation requires that SumatraPDF be deployed using the file-based sumatrapdfrestrict.ini restriction mechanism, and specifically applies when that INI is malformed or contains zero-valued permission settings - in which case InitializePolicies() leaves gPolicyRestrictions at Perm::All and never revokes any permission. Limiting factors that sharply reduce real-world exposure: the vulnerable path is irrelevant unless an administrator has intentionally configured INI-based lockdown; the alternative '-restrict' command-line path is NOT affected and enforces correctly; and access is local to the machine running the restricted instance. Default installations with no restriction policy are not impacted because there is nothing to bypass.

This is a genuine but narrowly-scoped security-control failure (CWE-636, fail-open), not a high-urgency widespread threat. The provided CVSS 4.0 vector (AV:L/AC:L/AT:P/PR:L/UI:P, base 5.4 medium) is internally consistent with the description: exploitation is local, requires the specific INI-based restriction deployment (reflected as AT:P), and yields high confidentiality/integrity/availability impact only within the sandbox the admin intended. No EPSS score, KEV listing, or public exploit is present in the input, so there is no public exploit identified at time of analysis and no evidence of active exploitation. The 'impact' here is bypass of an organization's own lockdown policy by a local user - it does not grant remote compromise or privilege escalation on the host. Priority should be elevated ONLY for organizations that deploy SumatraPDF in kiosk/locked-down mode via sumatrapdfrestrict.ini; for everyone else the real-world risk is negligible because the vulnerable code path is never exercised. Note that no fixed release version exists yet (only a fix commit), so affected deployers cannot simply patch.

An organization deploys SumatraPDF in a locked-down kiosk using sumatrapdfrestrict.ini to block disk, network, printing, clipboard, and fullscreen-exit actions. Because InitializePolicies() starts from Perm::All and only ORs bits, a malformed or zero-valued INI silently leaves all permissions granted, so a local kiosk user transparently performs every action the policy was meant to forbid. No public exploit is required - the bypass occurs automatically whenever the INI deployment method is used.