CVE-2026-107732: SumatraPDF: Markup/command-link injection into UI notification text
SumatraPDF is a multi-format reader for Windows. In 3.6.1 and earlier, untrusted document paths and PDF link targets are interpolated into notification text that ParseTip() interprets as trusted tip markup. When a user clicks an injected link, ExecuteTipLink() dispatches its CmdExec command and can execute an attacker-selected local program in the user's context. No broader impact is claimed beyond the advisory-supported conditions. No fixed version is available as of this review.
Affected Software
Event History
Frequently Asked Questions
Does exploitation require user interaction?
Yes. The user must click an injected link in the notification text before the command is dispatched.
What level of access could successful exploitation provide?
The attacker-selected local program can execute in the context of the affected user. The advisory does not claim impact beyond those conditions.
Which installations should be treated as exposed?
SumatraPDF versions 3.6.1 and earlier are affected. Installations can be identified by checking whether their deployed version is at or below 3.6.1.
Is a fixed release available?
No fixed version was available as of the review.