CVE-2026-107732

The multi-format reader SumatraPDF for Windows (version 3.6.1 and earlier ) is vulnerable to markup/command-link injection . The issue occurs because untrusted document paths and PDF link targets are interpolated into notification text, which the ParseTip() function interprets as trusted tip mark...

CVE-2026-107732 SumatraPDF: Markup/command-link injection into UI notification text

SumatraPDF is a multi-format reader for Windows. In 3.6.1 and earlier, untrusted document paths and PDF link targets are interpolated into notification text that ParseTip interprets as trusted tip markup. When a user clicks an injected link, ExecuteTipLink dispatches its CmdExec command and can...

CVE-2026-107732 SumatraPDF: Markup/command-link injection into UI notification text

SumatraPDF is a multi-format reader for Windows. In 3.6.1 and earlier, untrusted document paths and PDF link targets are interpolated into notification text that ParseTip interprets as trusted tip markup. When a user clicks an injected link, ExecuteTipLink dispatches its CmdExec command and can...

CVE-2026-107732

SumatraPDF is a multi-format reader for Windows. In 3.6.1 and earlier, untrusted document paths and PDF link targets are interpolated into notification text that ParseTip interprets as trusted tip markup. When a user clicks an injected link, ExecuteTipLink dispatches its CmdExec command and can...

CVE-2026-107731 SumatraPDF: LIT parser range-validation flaws cause invalid-pointer reads and denial of service

SumatraPDF is a multi-format reader for Windows. In 3.7.0.22298, four independently reachable range-validation variants in src/LitDoc.cpp allow file-controlled offsets and sizes to overflow, narrow to negative values, or wrap before incomplete bounds checks. The affected calculations include...

CVE-2026-107731 SumatraPDF: LIT parser range-validation flaws cause invalid-pointer reads and denial of service

SumatraPDF is a multi-format reader for Windows. In 3.7.0.22298, four independently reachable range-validation variants in src/LitDoc.cpp allow file-controlled offsets and sizes to overflow, narrow to negative values, or wrap before incomplete bounds checks. The affected calculations include...

CVE-2026-107731

The multi-format reader SumatraPDF version 3.7.0.22298 for Windows contains four independently reachable range-validation flaws in src/LitDoc.cpp . These flaws allow file-controlled offsets and sizes to overflow, narrow to negative values, or wrap before incomplete bounds checks. Specifically, th...

CVE-2026-107730 SumatraPDF: Signed integer overflow in the LIT header parsing causes invalid-pointer read

SumatraPDF is a multi-format reader for Windows. In 3.7.0.22298, LitParseHeader in src/LitDoc.cpp computes the attacker-controlled hdrLen + nPieces 16 section offset using signed 32-bit arithmetic without validating the complete result. When the component values make that aggregate calculation...

CVE-2026-107730

The multi-format reader SumatraPDF (version 3.7.0.22298 ) contains a signed integer overflow vulnerability in the LitParseHeader() function located in src/LitDoc.cpp . The issue occurs because the software uses signed 32-bit arithmetic to compute the section offset (hdrLen + nPieces * 16) without...

CVE-2026-107730 SumatraPDF: Signed integer overflow in the LIT header parsing causes invalid-pointer read

SumatraPDF is a multi-format reader for Windows. In 3.7.0.22298, LitParseHeader in src/LitDoc.cpp computes the attacker-controlled hdrLen + nPieces 16 section offset using signed 32-bit arithmetic without validating the complete result. When the component values make that aggregate calculation...

CVE-2026-107729

The multi-format reader SumatraPDF (version 3.7.0.22298) is vulnerable to an out-of-bounds read in src/MobiDoc.cpp during MOBI parsing. The root cause is an unsigned-to-signed conversion where the mobiHdr.hdrLen field is narrowed to a signed integer for validation. Values exceeding INT_MAX become...

CVE-2026-107729 SumatraPDF: Unsigned-to-signed hdrLen validation bypass in SumatraPDF MOBI parsing causes out-of-bounds read

SumatraPDF is a multi-format reader for Windows. In 3.7.0.22298, src/MobiDoc.cpp narrows the untrusted unsigned mobiHdr.hdrLen field to a signed integer for validation; values above INTMAX become negative and bypass the upper-bound check. When the EXTH flag is set, the original unsigned value is...

CVE-2026-107729 SumatraPDF: Unsigned-to-signed hdrLen validation bypass in SumatraPDF MOBI parsing causes out-of-bounds read

SumatraPDF is a multi-format reader for Windows. In 3.7.0.22298, src/MobiDoc.cpp narrows the untrusted unsigned mobiHdr.hdrLen field to a signed integer for validation; values above INTMAX become negative and bypass the upper-bound check. When the EXTH flag is set, the original unsigned value is...

CVE-2026-107732: Improper Control of Generation of Code

SumatraPDF is a multi-format reader for Windows. In 3.6.1 and earlier, untrusted document paths and PDF link targets are interpolated into notification text that ParseTip interprets as trusted tip markup. When a user clicks an injected link, ExecuteTipLink dispatches its CmdExec command and can...

CVE-2026-107802: Improper Neutralization of Argument Delimiters in a Command

SumatraPDF is a multi-format reader for Windows. In 3.6.1 and earlier, src/SelectionTranslate.cpp embeds selected or pasted translation text in quoted Windows command lines using incomplete quote-only escaping. The affected BuildGrokTranslateCmdLineTemp, BuildClaudeTranslateCmdLineTemp, and...

CVE-2026-107731: Out-of-bounds Read

SumatraPDF is a multi-format reader for Windows. In 3.7.0.22298, four independently reachable range-validation variants in src/LitDoc.cpp allow file-controlled offsets and sizes to overflow, narrow to negative values, or wrap before incomplete bounds checks. The affected calculations include...

PT-2026-108291

Name of the Vulnerable Software and Affected Versions SumatraPDF version 3.7.0.22298 Description An issue exists in the LitParseHeader function within src/LitDoc.cpp where the calculation of the section offset using hdrLen and nPieces is performed with signed 32-bit arithmetic without proper...

PT-2026-108306

Name of the Vulnerable Software and Affected Versions SumatraPDF versions prior to 3.6.2 Description The ChmFile::GetCharZ function narrows file-controlled unsigned string offsets from /WINDOWS and /IVB to signed integers without performing a lower-bound check. If an offset becomes negative, the...

PT-2026-108303

Name of the Vulnerable Software and Affected Versions SumatraPDF versions prior to 3.6.2 Description The InitializePolicies function incorrectly handles the sumatrapdfrestrict.ini path by initializing gPolicyRestrictions to Perm::All and only using OR operations for permission bits. This logic...

PT-2026-108294

Name of the Vulnerable Software and Affected Versions SumatraPDF versions prior to 3.6.2 Description The FrameOnCommand function handles CmdExec by passing a null current-tab pointer to RunWithExe, which then dereferences WindowTab::filePath. A local process within the same interactive Windows...