CVE-2026-107738

SumatraPDF versions 3.6.1 and earlier on Windows are vulnerable to an out-of-bounds read. The issue resides in the ChmFile::GetCharZ() function, which narrows file-controlled unsigned string offsets from /#WINDOWS and /#IVB to signed integers without performing a lower-bound check. If an offset b...

CVE-2026-107737 SumatraPDF CHM `its://` signed index causes an out-of-bounds object lookup

SumatraPDF is a multi-format reader for Windows. In 3.6.1 and earlier, and in pre-release 3.7.0.20369 when WebView2 is absent or cannot initialize, ParseProtoUrl accepts the signed host component of an its:// URL and FindHtmlWindowById uses it directly as an index into gHtmlWindows. Opening a...

CVE-2026-107737

SumatraPDF is a multi-format reader for Windows. In 3.6.1 and earlier, and in pre-release 3.7.0.20369 when WebView2 is absent or cannot initialize, ParseProtoUrl accepts the signed host component of an its:// URL and FindHtmlWindowById uses it directly as an index into gHtmlWindows. Opening a...

CVE-2026-107737

The multi-format reader SumatraPDF for Windows is vulnerable to an out-of-bounds object lookup in versions 3.6.1 and earlier , and in pre-release 3.7.0.20369 when WebView2 is absent or fails to initialize. The root cause lies in the ParseProtoUrl() function, which accepts the signed host componen...

CVE-2026-107737 SumatraPDF CHM `its://` signed index causes an out-of-bounds object lookup

SumatraPDF is a multi-format reader for Windows. In 3.6.1 and earlier, and in pre-release 3.7.0.20369 when WebView2 is absent or cannot initialize, ParseProtoUrl accepts the signed host component of an its:// URL and FindHtmlWindowById uses it directly as an index into gHtmlWindows. Opening a...

CVE-2026-107736 SumatraPDF: stack buffer overflow while processing EXIF Orientation metadata

SumatraPDF is a multi-format reader for Windows. In 3.6.1 and earlier, MaybeFlipBitmap asks GDI+ to read the attacker-controlled PropertyTagOrientation size through GetPropertyItem while supplying only a fixed 64-byte buf on the stack. Opening a crafted TIFF with enough EXIF Orientation values ca...

CVE-2026-107736 SumatraPDF: stack buffer overflow while processing EXIF Orientation metadata

SumatraPDF is a multi-format reader for Windows. In 3.6.1 and earlier, MaybeFlipBitmap asks GDI+ to read the attacker-controlled PropertyTagOrientation size through GetPropertyItem while supplying only a fixed 64-byte buf on the stack. Opening a crafted TIFF with enough EXIF Orientation values ca...

CVE-2026-107736

SumatraPDF (version 3.6.1 and earlier) on Windows is vulnerable to a stack buffer overflow during the processing of EXIF Orientation metadata. The issue resides in the MaybeFlipBitmap() function, which uses GDI+ to read an attacker-controlled PropertyTagOrientation size via GetPropertyItem() into...

CVE-2026-107735

SumatraPDF is a multi-format reader for Windows. In 3.6.1 and earlier, InitializePolicies starts the sumatrapdfrestrict.ini path with gPolicyRestrictions set to Perm::All and only ORs permission bits, so the INI file never revokes permissions. Deploying SumatraPDF with this INI file, including a...

CVE-2026-107735 SumatraPDF: `sumatrapdfrestrict.ini` never revokes any permission (fail-open policy initialization)

SumatraPDF is a multi-format reader for Windows. In 3.6.1 and earlier, InitializePolicies starts the sumatrapdfrestrict.ini path with gPolicyRestrictions set to Perm::All and only ORs permission bits, so the INI file never revokes permissions. Deploying SumatraPDF with this INI file, including a...

CVE-2026-107735 SumatraPDF: `sumatrapdfrestrict.ini` never revokes any permission (fail-open policy initialization)

SumatraPDF is a multi-format reader for Windows. In 3.6.1 and earlier, InitializePolicies starts the sumatrapdfrestrict.ini path with gPolicyRestrictions set to Perm::All and only ORs permission bits, so the INI file never revokes permissions. Deploying SumatraPDF with this INI file, including a...

CVE-2026-107735

The multi-format reader SumatraPDF (version 3.6.1 and earlier) on Windows contains a fail-open policy initialization flaw in the InitializePolicies() function. The application initializes the sumatrapdfrestrict.ini path with gPolicyRestrictions set to Perm::All and only performs bitwise OR operat...

CVE-2026-107734

SumatraPDF is a multi-format reader for Windows. In 3.5.2 and earlier, an attacker-controlled SyncTeX source filename is substituted for the %f placeholder in an external editor command line without safe Windows argument quoting, and the resulting command line is passed to CreateProcessW. A user...

CVE-2026-107734 SumatraPDF: SyncTeX Argument Injection in Inverse Search Enables Arbitrary Command Execution via External Editors

SumatraPDF is a multi-format reader for Windows. In 3.5.2 and earlier, an attacker-controlled SyncTeX source filename is substituted for the %f placeholder in an external editor command line without safe Windows argument quoting, and the resulting command line is passed to CreateProcessW. A user...

CVE-2026-107734 SumatraPDF: SyncTeX Argument Injection in Inverse Search Enables Arbitrary Command Execution via External Editors

SumatraPDF is a multi-format reader for Windows. In 3.5.2 and earlier, an attacker-controlled SyncTeX source filename is substituted for the %f placeholder in an external editor command line without safe Windows argument quoting, and the resulting command line is passed to CreateProcessW. A user...

CVE-2026-107734

SumatraPDF (version 3.5.2 and earlier) is vulnerable to SyncTeX Argument Injection during an inverse search. The root cause is the substitution of an attacker-controlled SyncTeX source filename for the %f placeholder in an external editor command line without employing safe Windows argument quoti...

CVE-2026-107733

SumatraPDF is a multi-format reader for Windows. In 3.6.1 and earlier, FrameOnCommand handles CmdExec by passing a null current-tab pointer to RunWithExe, which dereferences WindowTab::filePath. A local process in the same interactive Windows session, at an integrity level greater than or equal t...

CVE-2026-107733

In SumatraPDF version 3.6.1 and earlier for Windows, a null-pointer dereference occurs within the FrameOnCommand() function when handling CmdExec while no document tab is open. The root cause is the passing of a null current-tab pointer to RunWithExe(), leading to the dereferencing of WindowTab::...

CVE-2026-107733 SumatraPDF: Null-pointer dereference in `CmdExec` when no document tab is open

SumatraPDF is a multi-format reader for Windows. In 3.6.1 and earlier, FrameOnCommand handles CmdExec by passing a null current-tab pointer to RunWithExe, which dereferences WindowTab::filePath. A local process in the same interactive Windows session, at an integrity level greater than or equal t...

CVE-2026-107733 SumatraPDF: Null-pointer dereference in `CmdExec` when no document tab is open

SumatraPDF is a multi-format reader for Windows. In 3.6.1 and earlier, FrameOnCommand handles CmdExec by passing a null current-tab pointer to RunWithExe, which dereferences WindowTab::filePath. A local process in the same interactive Windows session, at an integrity level greater than or equal t...