CVE-2026-107733: CWE-476: NULL Pointer Dereference in sumatrapdfreader sumatrapdf
Description
CVE-2026-107733 is a NULL pointer dereference vulnerability in SumatraPDF version 3.6.1 and earlier. It occurs when the FrameOnCommand() function handles the CmdExec command by passing a null current-tab pointer to RunWithExe(), leading to a dereference of WindowTab::filePath. This can cause the SumatraPDF process to terminate abruptly if a local process in the same Windows session sends CmdExec via DDE or WM_COPYDATA while no document tab is open. The impact is limited to local denial of service with loss of unsaved state, with no broader impact reported. No fix is available as of the advisory date.
CVSS v4.0
Score 6.8medium
Affected software
sumatrapdfreader
sumatrapdf
pkg:github/sumatrapdfreader/sumatrapdfRun on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
SumatraPDF versions 3.6.1 and earlier contain a NULL pointer dereference vulnerability (CWE-476) triggered when FrameOnCommand() processes CmdExec by passing a null current-tab pointer to RunWithExe(), which then dereferences WindowTab::filePath. A local process with equal or higher integrity level in the same interactive Windows session can exploit this by dispatching CmdExec over DDE or WM_COPYDATA while no document tab is open, causing the SumatraPDF process to crash and lose unsaved data. The vulnerability requires local access and does not involve user interaction. No patch or fixed version is currently available.
Potential Impact
The vulnerability allows a local process in the same Windows session with an integrity level greater than or equal to SumatraPDF's to cause the SumatraPDF process to terminate unexpectedly, resulting in loss of unsaved state. There is no indication of privilege escalation, remote exploitation, or data compromise beyond the denial of service effect.
Mitigation Recommendations
No official fix or patch is available at this time. Users should avoid sending CmdExec commands via DDE or WM_COPYDATA to SumatraPDF when no document tab is open. Monitor vendor advisories for updates regarding remediation.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- GitHub_M
- Date Reserved
- 2026-10-08T17:21:52.976Z
- Cvss Version
- 4.0
- State
- PUBLISHED
Threat ID: 6ac81a602cdf04f6563e4d01
Added to database: 10/08/2026, 22:34:08 UTC
Last enriched: 10/08/2026, 22:48:46 UTC
Last updated: 10/08/2026, 22:49:04 UTC
Views: 11
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.