CVE-2026-107733: SumatraPDF: Null-pointer dereference in `CmdExec` when no document tab is open
SumatraPDF is a multi-format reader for Windows. In 3.6.1 and earlier, FrameOnCommand() handles CmdExec by passing a null current-tab pointer to RunWithExe(), which dereferences WindowTab::filePath. A local process in the same interactive Windows session, at an integrity level greater than or equal to SumatraPDF's under Windows UIPI, can dispatch CmdExec over DDE or WMCOPYDATA while no document tab is open, causing abrupt process termination and loss of unsaved state. No broader impact is claimed beyond the advisory-supported conditions. No fixed version is available as of this review.
Affected Software
Event History
Frequently Asked Questions
Who can trigger the issue?
A local process running in the same interactive Windows session can trigger it if its integrity level is greater than or equal to the SumatraPDF process under Windows UIPI. The process must be able to send the relevant DDE or WM_COPYDATA command.
What is the practical impact of successful exploitation?
Successful exploitation causes the SumatraPDF process to terminate abruptly, potentially losing unsaved state. The advisory does not claim impact beyond denial of service under the stated conditions.
Is a fixed release available?
No fixed version was available as of the review. The affected range is SumatraPDF 3.6.1 and earlier.