SumatraPDF versions 3.5.2 and earlier allow a malicious binary that resides in the same directory as an opened PDF to be executed when the user selects File → ‘Show in folder’. The application therefore launches the binary (in this case explorer.exe) without warning or further user interaction, giving the process the privileges of the current user and enabling arbitrary code execution.

Windows users who run SumatraPDF Reader version 3.5.2 or earlier are impacted; no other vendors or products are known to be affected.

The vulnerability has a CVSS score of 7.8, indicating high severity, while its EPSS score is below 1%, implying a low current exploitation probability. The exploit requires a local user to open a PDF and click the menu item, and an attacker must place a malicious executable next to the PDF; because of these prerequisites the threat is moderate, but the potential impact is critical.