CVE-2026-107734: CWE-20: Improper Input Validation in sumatrapdfreader sumatrapdf

CVE-2026-107734 describes an improper input validation vulnerability (CWE-20) in SumatraPDF up to version 3.5.2. The issue arises when an attacker-controlled SyncTeX source filename is substituted into an external editor command line without proper Windows argument quoting, and the command is executed via CreateProcessW(). This allows injection of command-line flags that the target editor may interpret, potentially causing unintended actions or code execution if the editor supports malicious extensions. The vulnerability requires a user to open a crafted PDF with a malicious .synctex.gz file and invoke inverse search with an external editor configured or auto-detected. No broader impacts beyond this scenario are claimed. No patch or fix is currently available.

The vulnerability can lead to unintended editor actions or code execution within the context of the external editor invoked by SumatraPDF. The impact depends on the target editor's interpretation of injected command-line flags and the presence of malicious extensions. There is no indication of broader system compromise or impact beyond the external editor process. Exploitation requires user interaction and specific conditions (configured external editor and crafted SyncTeX file).

No official fix or patch is currently available for this vulnerability. Users should avoid opening PDFs with untrusted or suspicious .synctex.gz files when using SumatraPDF with an external editor configured for inverse search. Monitoring vendor advisories for updates or patches is recommended.