SumatraPDF versions 3.6.1 and earlier contain an argument injection vulnerability in the SelectionTranslate.cpp source file. The issue arises from incomplete quote-only escaping when embedding selected or pasted translation text into Windows command lines. This flaw affects specific functions that build command lines for translation agents, potentially allowing attacker-controlled input to inject unauthorized command-line flags. No fixed version is currently available, and the vulnerability requires user interaction and local access. The impact is limited to scenarios where the corresponding agentic CLI backend is installed and used.
CVE-2026-107738 is an out-of-bounds read vulnerability in SumatraPDF version 3.6.1 and earlier. The issue occurs in the ChmFile::GetCharZ() function, which improperly converts unsigned string offsets to signed integers without checking for negative values. This can cause the function to read memory before the intended buffer, leading to deterministic application termination. No broader impact beyond application termination is reported. No fixed version is currently available.
CVE-2026-107737 is a medium severity vulnerability in SumatraPDF versions 3.6.1 and earlier, and in certain pre-release 3.7.0 builds without WebView2 support. It involves improper validation of an array index in the handling of its:// URLs, leading to an out-of-bounds pointer read and process termination when opening crafted CHM files via the IE fallback backend. No fixed version is currently available.
SumatraPDF is a multi-format reader for Windows. In 3.6.1 and earlier, MaybeFlipBitmap() asks GDI+ to read the attacker-controlled PropertyTagOrientation size through GetPropertyItem() while supplying only a fixed 64-byte buf on the stack. Opening a crafted TIFF with enough EXIF Orientation values can cause attacker-selected bytes to overwrite stack control data, while tested builds terminate through the stack cookie check. No broader impact is claimed beyond the advisory-supported conditions. No fixed version is available as of this review.
SumatraPDF is a multi-format reader for Windows. In 3.6.1 and earlier, InitializePolicies() starts the sumatrapdfrestrict.ini path with gPolicyRestrictions set to Perm::All and only ORs permission bits, so the INI file never revokes permissions. Deploying SumatraPDF with this INI file, including a malformed file or zero-valued permission settings, can silently bypass configured disk, network, printing, registry, clipboard, preference, and fullscreen restrictions. The -restrict command-line path works correctly and is not affected. No fixed version is available as of this review.
SumatraPDF is a multi-format reader for Windows. In 3.5.2 and earlier, an attacker-controlled SyncTeX source filename is substituted for the %f placeholder in an external editor command line without safe Windows argument quoting, and the resulting command line is passed to CreateProcessW(). A user with an external editor configured or auto-detected who opens a PDF with a crafted .synctex.gz file and invokes inverse search can inject command-line flags; the resulting impact depends on the target editor interpreting those flags and can include unintended editor actions or code execution through a malicious extension. No broader impact is claimed beyond the advisory-supported conditions. No fixed version is available as of this review.
SumatraPDF versions 3.6.1 and earlier contain a NULL pointer dereference vulnerability in the FrameOnCommand() function when handling CmdExec commands. This occurs if no document tab is open, allowing a local process with appropriate integrity level to cause the application to crash by dispatching CmdExec via DDE or WM_COPYDATA. The impact is limited to abrupt termination and loss of unsaved state, with no broader effects reported. No fix is currently available.
SumatraPDF versions 3.6.1 and earlier contain a code injection vulnerability where untrusted document paths and PDF link targets are improperly handled in notification text. This allows an attacker to inject commands that execute a local program when a user clicks a crafted link. No fixed version is currently available.
SumatraPDF is a multi-format reader for Windows. In 3.7.0.22298, four independently reachable range-validation variants in src/LitDoc.cpp allow file-controlled offsets and sizes to overflow, narrow to negative values, or wrap before incomplete bounds checks. The affected calculations include contentOffset, the directory expression dirOff64 + dirLen64, and the decoded-section offset + size, along with secondary-header range handling. Opening a crafted LIT file that reaches one of these variants can cause invalid pointer reads and deterministic application termination. No broader impact is claimed beyond the advisory-supported conditions. No fixed version is available as of this review.
SumatraPDF is a multi-format reader for Windows. In 3.7.0.22298, LitParseHeader() in src/LitDoc.cpp computes the attacker-controlled hdrLen + nPieces * 16 section offset using signed 32-bit arithmetic without validating the complete result. When the component values make that aggregate calculation overflow to a negative value, pointer construction reaches an invalid read in LitU32(), causing deterministic application termination. The supplied evidence does not demonstrate code execution, information disclosure, arbitrary read, or integrity impact. No fixed version is available as of this review.
SumatraPDF is a multi-format reader for Windows. In 3.7.0.22298, src/MobiDoc.cpp narrows the untrusted unsigned mobiHdr.hdrLen field to a signed integer for validation; values above INT_MAX become negative and bypass the upper-bound check. When the EXTH flag is set, the original unsigned value is reused as a pointer offset, causing DecodeExthHeader() to read beyond the record buffer. Opening a crafted MOBI file can reliably terminate the application with a native access violation; no code execution, information disclosure, or integrity impact has been demonstrated. No fixed version is available as of this review.
SumatraPDF is a multi-format reader for Windows. Prior to 3.6, the MobiDoc::ParseHeader function in src/MobiDoc.cpp validates a record using kMobiHeaderMinLen but DecodeMobiDocHeader constructs a decoder sized for kMobiHeaderLen without receiving the actual remaining buffer length. A malformed MOBI file can use an attacker-controlled header length to bypass optional-field early returns and cause the decoder to read beyond a short heap buffer. Opening the crafted document can crash SumatraPDF. This issue is fixed in version 3.6.
SumatraPDF versions 3.6.1 and earlier contain a heap memory corruption vulnerability in the CHM file parser. A crafted CHM file with malformed LZX Huffman code lengths can cause out-of-bounds writes in the decompression code, leading to heap corruption. While arbitrary code execution has not been demonstrated, the flaw poses a risk of memory corruption during parsing. No fixed version is currently available.
CVE-2026-25961 is a high-severity vulnerability in SumatraPDF versions 3.5.0 through 3.5.2 affecting its update mechanism. The flaw disables TLS hostname verification during update checks and executes installers without verifying their digital signatures. This allows a network attacker with any valid TLS certificate, including free certificates like Let's Encrypt, to intercept update requests and inject malicious installer URLs. Successful exploitation results in arbitrary code execution on the victim's Windows system. No known exploits are currently reported in the wild. The vulnerability impacts confidentiality, integrity, and availability due to the potential for full system compromise.
SumatraPDF is a multi-format reader for Windows. In 3.5.2 and earlier, a heap out-of-bounds read vulnerability exists in SumatraPDF's MOBI HuffDic decompressor. The bounds check in AddCdicData() only validates half the range that DecodeOne() actually accesses. Opening a crafted .mobi file can read nearly (1 << codeLength) bytes beyond the CDIC dictionary buffer, leading to a crash.
CVE-2026-25880 is a high-severity vulnerability in SumatraPDF versions 3.5.2 and earlier, involving an untrusted search path weakness (CWE-426). When a user opens a PDF and clicks File → “Show in folder”, the application executes a binary named explorer.exe located in the same directory as the PDF without proper validation. This allows an attacker to place a malicious executable in the PDF’s folder, leading to arbitrary code execution with the current user's privileges. Exploitation requires user interaction limited to clicking the menu option, with no additional warnings. The vulnerability affects Windows systems running vulnerable SumatraPDF versions. Although no known exploits are reported in the wild yet, the ease of exploitation and high impact on confidentiality, integrity, and availability make this a significant threat. European organizations using SumatraPDF on Windows should prioritize patching or mitigating this issue to prevent potential compromise.
CVE-2026-23951 is a medium severity vulnerability in SumatraPDF (versions up to 3.5.2rel) caused by an off-by-one error in PalmDbReader::GetRecord when processing crafted Mobi files. This leads to an integer underflow during size calculation, resulting in an out-of-bounds heap read that crashes the application. Exploitation requires local access and user interaction to open a malicious file, with no impact on confidentiality or integrity, only availability. No patches are currently available, and no known exploits exist in the wild. European organizations using SumatraPDF for document reading may experience denial of service if targeted. Mitigation involves avoiding opening untrusted Mobi files and monitoring for updates from the vendor. Countries with higher usage of SumatraPDF and significant document handling needs, such as Germany, France, and the UK, are most likely to be affected.
SumatraPDF is a multi-format reader for Windows. In 3.5.2 and earlier, there is a Untrusted Search Path vulnerability when Advanced Options setting is trigger. The application executes notepad.exe without specifying an absolute path when using the Advanced Options setting. On Windows, this allows execution of a malicious notepad.exe placed in the application's installation directory, leading to arbitrary code execution.
