Description
SumatraPDF is a multi-format reader for Windows. In 3.6.1 and earlier, FrameOnCommand() handles CmdExec by passing a null current-tab pointer to RunWithExe(), which dereferences WindowTab::filePath. A local process in the same interactive Windows session, at an integrity level greater than or equal to SumatraPDF's under Windows UIPI, can dispatch CmdExec over DDE or WM_COPYDATA while no document tab is open, causing abrupt process termination and loss of unsaved state. No broader impact is claimed beyond the advisory-supported conditions. No fixed version is available as of this review.
Published: 2026-10-08
Score: 6.8 Medium
EPSS: < 1% Very Low
KEV: No
Impact: Local Denial of Service
Action: Assess Impact
AI Analysis

Impact

SumatraPDF allows a local process with an integrity level equal to or higher than the viewer to trigger a CmdExec command through DDE or WM_COPYDATA when no document tab is open. The command is forwarded to a function that dereferences a null current‑tab pointer, which results in a crash and loss of any unsaved application state. The vulnerability is a classic null‑pointer dereference (CWE-476) and leads only to a denial of availability for the local user.

Affected Systems

Affected software is SumatraPDF (sumatrapdfreader:sumatrapdf) version 3.6.1 and older. No fixed version has been released as of the latest advisory.

Risk and Exploitability

The CVSS score of 6.8 indicates moderate severity. EPSS is not available and the vulnerability is not listed in the CISA KEV catalog. Attackers require a local, interactive Windows session and an application of at least the same integrity level as SumatraPDF, which limits the risk to environments where privileged local code can be executed. The primary vector is local execution of CmdExec via DDE or WM_COPYDATA; no network‑based or remote exploitation is described.

Generated by OpenCVE AI on October 8, 2026 at 23:36 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Check for newer SumatraPDF releases that contain a fix; if none is available, consider switching to an alternative PDF viewer with similar functionality.
  • Disable or restrict the use of DDE and WM_COPYDATA from untrusted local processes in the environment, or isolate SumatraPDF in a lower‑integrity container to prevent privilege‑elevated injection.
  • Ensure that SumatraPDF is only run from trusted user accounts and that administrative scripts do not invoke CmdExec on the viewer when no document is open.

Generated by OpenCVE AI on October 8, 2026 at 23:36 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Wed, 14 Oct 2026 02:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Fri, 09 Oct 2026 00:00:00 +0000

Type Values Removed Values Added
First Time appeared Sumatrapdfreader
Sumatrapdfreader sumatrapdf
Vendors & Products Sumatrapdfreader
Sumatrapdfreader sumatrapdf

Thu, 08 Oct 2026 22:30:00 +0000

Type Values Removed Values Added
Description SumatraPDF is a multi-format reader for Windows. In 3.6.1 and earlier, FrameOnCommand() handles CmdExec by passing a null current-tab pointer to RunWithExe(), which dereferences WindowTab::filePath. A local process in the same interactive Windows session, at an integrity level greater than or equal to SumatraPDF's under Windows UIPI, can dispatch CmdExec over DDE or WM_COPYDATA while no document tab is open, causing abrupt process termination and loss of unsaved state. No broader impact is claimed beyond the advisory-supported conditions. No fixed version is available as of this review.
Title SumatraPDF: Null-pointer dereference in `CmdExec` when no document tab is open
Weaknesses CWE-476
References
Metrics cvssV4_0

{'score': 6.8, 'vector': 'CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N'}

Subscriptions

Sumatrapdfreader Sumatrapdf
cve-icon MITRE

Status: PUBLISHED

Assigner: GitHub_M

Published:

Updated: 2026-10-14T01:33:16.443Z

Reserved: 2026-10-08T17:21:52.976Z

Link: CVE-2026-107733

cve-icon Vulnrichment

Updated: 2026-10-14T01:33:08.907Z

cve-icon NVD

Status : Deferred

Published: 2026-10-08T23:16:59.050

Modified: 2026-10-14T02:16:58.120

Link: CVE-2026-107733

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-08T23:45:16Z

Weaknesses