SumatraPDF: Command injection via crafted links in notification text
Summary
SumatraPDF up to and including 3.6.1 inserts untrusted document paths and PDF link targets into notification text, which is then parsed as trusted tip markup. If a user clicks an injected link, an attacker-selected local program runs in the user's context. The attacker needs a crafted PDF or document that triggers an error notification, plus a user click; no authentication is required. No fixed version is available.
Affected
- SumatraPDF 3.6.1 and earlier (Windows)
Fixed in
- Unknown. The vendor commit 8b680387ed69e3504ef296e09d6e032f81076af8 addresses the issue, but no release containing the fix has been identified.
Workaround
- No vendor workaround is published.
- Do not open untrusted PDFs or documents in SumatraPDF.
- Use another PDF reader until a fixed release is confirmed.
- Restrict program execution from user-writable locations with AppLocker or WDAC.
Exploitation
- CISA SSVC: exploitation none, not automatable, total technical impact.
- No in-the-wild exploitation is known.
- Public exploit status is unverified and conflicting.
Our recommendation
- Inventory SumatraPDF installations and flag versions 3.6.1 and earlier.
- Replace or restrict SumatraPDF on high-risk workstations until a fix is confirmed.
- Tighten handling of PDFs from email and downloads, and train users to be careful with unexpected documents and links.
- Monitor GHSA-2wv2-qm2f-vmxh and NVD for a fixed release.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- GitHub Security Advisory GHSA-2wv2-qm2f-vmxh github.com
- GitHub commit 8b680387ed69e3504ef296e09d6e032f81076af8 github.com
- OSV: CVE-2026-107732 osv.dev
- VulDB: CVE-2026-107732 vuldb.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 12:42.
Original description (NVD)
SumatraPDF is a multi-format reader for Windows. In 3.6.1 and earlier, untrusted document paths and PDF link targets are interpolated into notification text that ParseTip() interprets as trusted tip markup. When a user clicks an injected link, ExecuteTipLink() dispatches its CmdExec command and can execute an attacker-selected local program in the user's context. No broader impact is claimed beyond the advisory-supported conditions. No fixed version is available as of this review.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.