SumatraPDF versions 3.6.1 and earlier contain a logic flaw in policy initialization: the file sumatrapdfrestrict.ini is opened with all permissions enabled and only permission bits are accumulated with OR. Consequently, the INI file can never revoke any permissions, allowing any configuration changes it contains to silently overwrite the program’s security restrictions. As a result, an attacker who can supply a custom or malformed INI file can bypass disk, network, printing, registry, clipboard, preference, and fullscreen restrictions that were intended to be enforced, potentially exposing the host to additional actions that the environment otherwise would have blocked.

The vulnerability affects installations of SumatraPDF by sumatrapdfreader, specifically the sumatrapdf product. Versions 3.6.1 and earlier are impacted. No fixed release is available at the time of this review.

The CVSS score of 5.4 indicates a moderate severity. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog. The likely attack vector is local or delegated through the ability to supply a custom sumatrapdfrestrict.ini file; an attacker would need access to the application’s file system or the ability to supply the file during deployment. Once the file is processed, all configured restrictions are silently cleared, granting the attacker permissions equivalent to anyone who can run SumatraPDF on the system.