The flaw exists in SumatraPDF versions up to 3.5.2 and earlier. An attacker‑controlled SyncTeX source filename is substituted for the %f placeholder in the external editor command line, and the resulting string is passed unquoted to CreateProcessW. This allows injection of command‑line flags that can trigger unintended editor actions or execute code through a malicious extension when a user opens a PDF that triggers inverse search.

The vulnerability affects Windows computers running SumatraPDF Reader, specifically versions 3.5.2 and earlier. No patched release is available at the time of this advisory, and the vendor has not issued a fix through the cited advisory.

The CVSS score of 7.1 reflects moderate severity. The EPSS score is not available, but the requirement for user interaction and the specific context of opening a crafted PDF file limits the likelihood of widespread exploitation. The vulnerability is not listed in the CISA KEV catalog. The attack vector is local, relying on a user who has an external editor configured or auto‑detected and who opens a PDF with the malicious .synctex.gz file, potentially leading to code execution dependent on the editor’s handling of injected flags.