CVE-2026-107735: SumatraPDF: `sumatrapdfrestrict.ini` never revokes any permission (fail-open policy initialization)
SumatraPDF is a multi-format reader for Windows. In 3.6.1 and earlier, InitializePolicies() starts the sumatrapdfrestrict.ini path with gPolicyRestrictions set to Perm::All and only ORs permission bits, so the INI file never revokes permissions. Deploying SumatraPDF with this INI file, including a malformed file or zero-valued permission settings, can silently bypass configured disk, network, printing, registry, clipboard, preference, and fullscreen restrictions. The -restrict command-line path works correctly and is not affected. No fixed version is available as of this review.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Compensating control
Use SumatraPDF's -restrict command-line path instead of relying on sumatrapdfrestrict.ini; this path works correctly and is not affected.
Event History
Frequently Asked Questions
Which deployments are affected?
Deployments using sumatrapdfrestrict.ini to enforce restrictions are affected in SumatraPDF 3.6.1 and earlier. The -restrict command-line enforcement path works correctly and is not affected.
What permissions can remain available despite the INI policy?
Configured restrictions on disk, network, printing, registry, clipboard, preferences, and fullscreen access can be silently bypassed. This also applies when the INI file is malformed or uses zero-valued permission settings.
What can be done if a fix is not available?
Do not rely on sumatrapdfrestrict.ini to revoke permissions. Use the -restrict command-line path, which is identified as working correctly, until a fixed version is available.
How can an administrator determine whether their restrictions are ineffective?
Check whether SumatraPDF is launched with sumatrapdfrestrict.ini rather than the -restrict command-line path. On affected versions, any intended permission revocations in the INI file do not take effect, including restrictions expressed through malformed or zero-valued settings.