CVE-2026-107734: SumatraPDF: SyncTeX Argument Injection in Inverse Search Enables Arbitrary Command Execution via External Editors
SumatraPDF is a multi-format reader for Windows. In 3.5.2 and earlier, an attacker-controlled SyncTeX source filename is substituted for the %f placeholder in an external editor command line without safe Windows argument quoting, and the resulting command line is passed to CreateProcessW(). A user with an external editor configured or auto-detected who opens a PDF with a crafted .synctex.gz file and invokes inverse search can inject command-line flags; the resulting impact depends on the target editor interpreting those flags and can include unintended editor actions or code execution through a malicious extension. No broader impact is claimed beyond the advisory-supported conditions. No fixed version is available as of this review.
Affected Software
Event History
Frequently Asked Questions
Who is exposed to this issue?
Users of SumatraPDF 3.5.2 and earlier are exposed only when an external editor is configured or auto-detected, they open a PDF with a crafted .synctex.gz file, and they invoke inverse search.
What must an attacker rely on to achieve code execution?
The attacker needs control of the SyncTeX source filename and must induce the user to invoke inverse search. The target external editor must also interpret injected command-line flags in a way that permits unintended actions or code execution, such as through a malicious extension.
What can be done while no fixed version is available?
Avoid invoking inverse search for PDFs with untrusted accompanying SyncTeX data. Disabling or avoiding configured and auto-detected external-editor integration removes a required condition for exploitation.
How can I determine whether a system is affected?
Check whether the installed SumatraPDF version is 3.5.2 or earlier and whether an external editor is configured or auto-detected. Systems without use of inverse search through an external editor do not meet the advisory-supported exploitation conditions.