CVE-2026-107732 SumatraPDF: Markup/command-link injection into UI notification text

SumatraPDF is a multi-format reader for Windows. In 3.6.1 and earlier, untrusted document paths and PDF link targets are interpolated into notification text that ParseTip interprets as trusted tip markup. When a user clicks an injected link, ExecuteTipLink dispatches its CmdExec command and can...

CVE-2026-107732 SumatraPDF: Markup/command-link injection into UI notification text

SumatraPDF is a multi-format reader for Windows. In 3.6.1 and earlier, untrusted document paths and PDF link targets are interpolated into notification text that ParseTip interprets as trusted tip markup. When a user clicks an injected link, ExecuteTipLink dispatches its CmdExec command and can...

CVE-2026-107732

The multi-format reader SumatraPDF for Windows (version 3.6.1 and earlier ) is vulnerable to markup/command-link injection . The issue occurs because untrusted document paths and PDF link targets are interpolated into notification text, which the ParseTip() function interprets as trusted tip mark...