sumatrapdf vulnerabilities
CVEs whose affected-version data names the sumatrapdf package. Each record lists the affected and patched versions; check a specific version with the dependency checker or POST /api/sbom.
12 CVEsRSS
CVE-2026-107802High· 7.1PoCSumatraPDF is a multi-format reader for Windows
SumatraPDF is a multi-format reader for Windows. In 3.6.1 and earlier, src/SelectionTranslate.cpp embeds selected or pasted translation text in quoted Windows command lines using incomplete quote-only escaping. The affected BuildGrokTran…
CVE-2026-107738Medium· 6.8SumatraPDF is a multi-format reader for Windows
SumatraPDF is a multi-format reader for Windows. In 3.6.1 and earlier, ChmFile::GetCharZ() narrows file-controlled unsigned string offsets from /#WINDOWS and /#IVB to signed integers without a lower-bound check. An offset that becomes ne…
CVE-2026-107737Medium· 5.7PoCSumatraPDF is a multi-format reader for Windows
SumatraPDF is a multi-format reader for Windows. In 3.6.1 and earlier, and in pre-release 3.7.0.20369 when WebView2 is absent or cannot initialize, ParseProtoUrl() accepts the signed host component of an its:// URL and FindHtmlWindowById…
CVE-2026-107736Medium· 6.8SumatraPDF is a multi-format reader for Windows
SumatraPDF is a multi-format reader for Windows. In 3.6.1 and earlier, MaybeFlipBitmap() asks GDI+ to read the attacker-controlled PropertyTagOrientation size through GetPropertyItem() while supplying only a fixed 64-byte buf on the stac…
CVE-2026-107735Medium· 5.4PoCSumatraPDF is a multi-format reader for Windows
SumatraPDF is a multi-format reader for Windows. In 3.6.1 and earlier, InitializePolicies() starts the sumatrapdfrestrict.ini path with gPolicyRestrictions set to Perm::All and only ORs permission bits, so the INI file never revokes perm…
CVE-2026-107734High· 7.1PoCSumatraPDF is a multi-format reader for Windows
SumatraPDF is a multi-format reader for Windows. In 3.5.2 and earlier, an attacker-controlled SyncTeX source filename is substituted for the %f placeholder in an external editor command line without safe Windows argument quoting, and the…
CVE-2026-107733Medium· 6.8PoCSumatraPDF is a multi-format reader for Windows
SumatraPDF is a multi-format reader for Windows. In 3.6.1 and earlier, FrameOnCommand() handles CmdExec by passing a null current-tab pointer to RunWithExe(), which dereferences WindowTab::filePath. A local process in the same interactiv…
CVE-2026-107732High· 8.4SumatraPDF is a multi-format reader for Windows
SumatraPDF is a multi-format reader for Windows. In 3.6.1 and earlier, untrusted document paths and PDF link targets are interpolated into notification text that ParseTip() interprets as trusted tip markup. When a user clicks an injected…
CVE-2026-107731Medium· 5.5SumatraPDF is a multi-format reader for Windows
SumatraPDF is a multi-format reader for Windows. In 3.7.0.22298, four independently reachable range-validation variants in src/LitDoc.cpp allow file-controlled offsets and sizes to overflow, narrow to negative values, or wrap before inco…
CVE-2026-107730Medium· 5.5SumatraPDF is a multi-format reader for Windows
SumatraPDF is a multi-format reader for Windows. In 3.7.0.22298, LitParseHeader() in src/LitDoc.cpp computes the attacker-controlled hdrLen + nPieces * 16 section offset using signed 32-bit arithmetic without validating the complete resu…
CVE-2026-107729Medium· 5.5SumatraPDF is a multi-format reader for Windows
SumatraPDF is a multi-format reader for Windows. In 3.7.0.22298, src/MobiDoc.cpp narrows the untrusted unsigned mobiHdr.hdrLen field to a signed integer for validation; values above INT_MAX become negative and bypass the upper-bound chec…
CVE-2026-26054Medium· 6.8PoCSumatraPDF is a multi-format reader for Windows
SumatraPDF is a multi-format reader for Windows. Prior to 3.6, the MobiDoc::ParseHeader function in src/MobiDoc.cpp validates a record using kMobiHeaderMinLen but DecodeMobiDocHeader constructs a decoder sized for kMobiHeaderLen without …