Is CVE-2026-107733 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-107733 being exploited in the wild.

How severe is CVE-2026-107733?

Informational severity, published 8 October 2026.

How is CVE-2026-107733 attacked?

It is attacked with local access, in a software library.

Am I affected by CVE-2026-107733?

Check whether you run SumatraPDF at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-107733: SumatraPDF null-pointer dereference in CmdExec

CVE-2026-107733 · Severity: info · Published 2026-10-08

SumatraPDF is a document reader for Windows that handles PDFs and other file formats. When no document is open, a local process can crash the application using inter-process commands (DDE or WM_COPYDATA), causing loss of unsaved work such as annotations. The crash occurs because the application fails to validate that a document is loaded before processing external viewer commands.

Technologies: SumatraPDF. Vendors: SumatraPDF.

Quick answers

Is CVE-2026-107733 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-107733 being exploited in the wild.
How severe is CVE-2026-107733?: Informational severity, published 8 October 2026.
Which products and versions are affected?: SumatraPDF 3.6.1 and earlier.
Is there a fix for CVE-2026-107733?: A patch was published on 2026-10-08: Fix demonstrated in commit 013ad65 but no official release version specified Until you apply it: Ensure a document is always open in SumatraPDF before untrusted local processes can interact with it, or run SumatraPDF at the highest available integrity level in your session to restrict inter-process communication from lower-integrity processes via Windows UIPI.</anigation> </invoke> Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-107733 attacked?: It is attacked with local access, in a software library.
Am I affected by CVE-2026-107733?: Check whether you run SumatraPDF at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Ensure a document is always open in SumatraPDF before untrusted local processes can interact with it, or run SumatraPDF at the highest available integrity level in your session to restrict inter-process communication from lower-integrity processes via Windows UIPI.</anigation> </invoke>

Technical details

A null-pointer dereference exists in FrameOnCommand() where CmdExec passes the current tab pointer to RunWithExe() without null-checking, while an adjacent handler (CmdViewWithExternalViewer) does perform this check. RunWithExe() immediately dereferences tab->filePath, causing an access violation when no document tab is active. A local process at equal or higher integrity level can dispatch this command over DDE or WM_COPYDATA without authentication, achieving denial of service only.

Affected products

SumatraPDF SumatraPDF 3.6.1 and earlier

Timeline

2026-08-12: disclosed
2026-10-08: advisory
2026-10-08: patched: Fix demonstrated in commit 013ad65 but no official release version specified

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.