CVE-2026-107733 SumatraPDF: Null-pointer dereference in `CmdExec` when no document tab is open
A local attacker can crash SumatraPDF by sending specific messages when no document is open, causing denial of service.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-107733?
CVE-2026-107733 is a medium-severity vulnerability in sumatrapdfreader sumatrapdf, published on 8 Oct 2026. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
SumatraPDF is a multi-format reader for Windows. In 3.6.1 and earlier, FrameOnCommand() handles CmdExec by passing a null current-tab pointer to RunWithExe(), which dereferences WindowTab::filePath. A local process in the same interactive Windows session, at an integrity level greater than or equal to SumatraPDF's under Windows UIPI, can dispatch CmdExec over DDE or WM_COPYDATA while no document tab is open, causing abrupt process termination and loss of unsaved state. No broader impact is claimed beyond the advisory-supported conditions. No fixed version is available as of this review.
Weakness: CWE-476
Which versions are affected by CVE-2026-107733?
How do I fix CVE-2026-107733?
No fix has been published for CVE-2026-107733 yet. Limit exposure of the affected software until one is available.
Is CVE-2026-107733 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-107733 exists.
Sources
Also known as GHSA-p2ph-2rvm-q37m.