CVE-2026-107732: CWE-94: Improper Control of Generation of Code ('Code Injection') in sumatrapdfreader sumatrapdf
Description
SumatraPDF versions 3.6.1 and earlier contain a code injection vulnerability where untrusted document paths and PDF link targets are improperly handled in notification text. This allows an attacker to craft a link that, when clicked by the user, executes a local program under the user's context. No fixed version is currently available.
CVSS v4.0
Score 8.4high
Affected software
sumatrapdfreader
sumatrapdf
pkg:github/sumatrapdfreader/sumatrapdfRun on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
CVE-2026-107732 describes a code injection vulnerability (CWE-94) in SumatraPDF up to version 3.6.1. The vulnerability arises because untrusted document paths and PDF link targets are interpolated into notification text processed by ParseTip() as trusted markup. When a user clicks an injected link, ExecuteTipLink() executes the associated CmdExec command, enabling execution of an attacker-selected local program with the user's privileges. The advisory does not claim any broader impact beyond this execution vector. No patch or fixed version is available at the time of this analysis.
Potential Impact
An attacker can execute arbitrary local programs on the victim's machine with the user's privileges by tricking the user into clicking a maliciously crafted link in a PDF document. This can lead to local code execution but does not escalate privileges or affect other systems beyond the user's context.
Mitigation Recommendations
No official fix or patch is currently available for this vulnerability. Users should avoid opening untrusted PDF documents or clicking suspicious links within SumatraPDF until a fix is released.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- GitHub_M
- Date Reserved
- 2026-10-08T17:21:52.976Z
- Cvss Version
- 4.0
- State
- PUBLISHED
Threat ID: 6ac81a602cdf04f6563e4d00
Added to database: 10/08/2026, 22:34:08 UTC
Last enriched: 10/08/2026, 22:48:50 UTC
Last updated: 10/08/2026, 22:49:04 UTC
Views: 10
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.