SumatraPDF processes untrusted document paths and PDF link targets by interpolating them into UI notification text. The ParseTip() function interprets this text as trusted tip markup, and when the user clicks an injected link, ExecuteTipLink() runs the CmdExec command, allowing an attacker to launch a local program in the current user’s context. The vulnerability thus permits an attacker to execute arbitrary code on the victim’s machine when the victim views a malicious document.

The affected product is SumatraPDF version 3.6.1 and earlier. It is distributed by sumatrapdfreader:sumatrapdf. Any installation of these versions that processes untrusted document paths or PDF link targets is vulnerable.

The CVSS score of 8.4 indicates a High severity. EPSS is not available, and the vulnerability is not listed in the CISA KEV catalog. The likely attack path is local; an attacker must supply a document or path that includes malicious markup and convince a user to open it. Once the injected link is clicked, the malicious program executes with the user’s privileges. The risk is confined to the user’s environment, and no broader impact beyond what is described has been reported.