# CVE-2026-107733: SumatraPDF null-pointer dereference in CmdExec

Source: https://junglewise.ai/threats/cve-2026-107733-sumatrapdf-is-a-multi-format-reader-for-windows-in-3-6-1-and  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-08. Updated: 2026-10-16  
License: CC BY 4.0 with a link back

CVE-2026-107733 · Severity: info · Published 2026-10-08

SumatraPDF is a document reader for Windows that handles PDFs and other file formats. When no document is open, a local process can crash the application using inter-process commands (DDE or WM_COPYDATA), causing loss of unsaved work such as annotations. The crash occurs because the application fails to validate that a document is loaded before processing external viewer commands.

Technologies: [SumatraPDF](https://junglewise.ai/threats/technologies/sumatrapdf). Vendors: [SumatraPDF](https://junglewise.ai/threats/vendors/sumatrapdf).

## Quick answers

**Is CVE-2026-107733 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-107733 being exploited in the wild.

**How severe is CVE-2026-107733?** Informational severity, published 8 October 2026.

**Which products and versions are affected?** SumatraPDF 3.6.1 and earlier.

**Is there a fix for CVE-2026-107733?** A patch was published on 2026-10-08: Fix demonstrated in commit 013ad65 but no official release version specified Until you apply it: Ensure a document is always open in SumatraPDF before untrusted local processes can interact with it, or run SumatraPDF at the highest available integrity level in your session to restrict inter-process communication from lower-integrity processes via Windows UIPI.</anigation>
</invoke> Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-107733 attacked?** It is attacked with local access, in a software library.

**Am I affected by CVE-2026-107733?** Check whether you run SumatraPDF at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix


Ensure a document is always open in SumatraPDF before untrusted local processes can interact with it, or run SumatraPDF at the highest available integrity level in your session to restrict inter-process communication from lower-integrity processes via Windows UIPI.</anigation>
</invoke>

## Technical details

A null-pointer dereference exists in FrameOnCommand() where CmdExec passes the current tab pointer to RunWithExe() without null-checking, while an adjacent handler (CmdViewWithExternalViewer) does perform this check. RunWithExe() immediately dereferences tab->filePath, causing an access violation when no document tab is active. A local process at equal or higher integrity level can dispatch this command over DDE or WM_COPYDATA without authentication, achieving denial of service only.

## Affected products

- SumatraPDF SumatraPDF 3.6.1 and earlier

## Timeline

- 2026-08-12: disclosed
- 2026-10-08: advisory
- 2026-10-08: patched: Fix demonstrated in commit 013ad65 but no official release version specified

## References

- [https://github.com/sumatrapdfreader/sumatrapdf/commit/013ad659c7de13fa15624d1f8a24e3231c50516b](https://github.com/sumatrapdfreader/sumatrapdf/commit/013ad659c7de13fa15624d1f8a24e3231c50516b)
- [https://github.com/sumatrapdfreader/sumatrapdf/security/advisories/GHSA-p2ph-2rvm-q37m](https://github.com/sumatrapdfreader/sumatrapdf/security/advisories/GHSA-p2ph-2rvm-q37m)

## Related threats

- [SumatraPDF TLS hostname validation bypass in HttpGet](https://junglewise.ai/threats/cve-2026-115758-sumatrapdf-is-a-multi-format-reader-for-windows-in-version-3-6-1)
- [SumatraPDF command-line argument injection in AI translation](https://junglewise.ai/threats/cve-2026-107802-sumatrapdf-is-a-multi-format-reader-for-windows-in-3-6-1-and)
- [SumatraPDF out-of-bounds read in CHM parser](https://junglewise.ai/threats/cve-2026-107738-sumatrapdf-is-a-multi-format-reader-for-windows-in-3-6-1-and)
- [SumatraPDF out-of-bounds pointer read in its:// window lookup](https://junglewise.ai/threats/cve-2026-107737-sumatrapdf-is-a-multi-format-reader-for-windows-in-3-6-1-and)
- [SumatraPDF stack buffer overflow in EXIF Orientation parsing](https://junglewise.ai/threats/cve-2026-107736-sumatrapdf-is-a-multi-format-reader-for-windows-in-3-6-1-and)