Quick answers
- Is CVE-2026-107735 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-107735 being exploited in the wild.
- How severe is CVE-2026-107735?
- Informational severity, published 8 October 2026.
- Which products and versions are affected?
- SumatraPDF 3.6.1 and earlier.
- Is there a fix for CVE-2026-107735?
- No fixed version is recorded yet. Use the -restrict command-line flag instead of the sumatrapdfrestrict.ini file, as the command-line restriction mechanism functions correctly and is not affected by this vulnerability. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
- How is CVE-2026-107735 attacked?
- It is attacked with local access, in a network appliance.
- Am I affected by CVE-2026-107735?
- Check whether you run SumatraPDF at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
How to fix
Use the -restrict command-line flag instead of the sumatrapdfrestrict.ini file, as the command-line restriction mechanism functions correctly and is not affected by this vulnerability.
Technical details
The InitializePolicies() function initializes gPolicyRestrictions to Perm::All (all permissions granted) and only ORs additional permission bits when reading the sumatrapdfrestrict.ini file, never clearing bits to revoke permissions. A malformed or missing INI section similarly fails open to full permissions instead of the intended fail-closed state. The command-line -restrict flag is unaffected and works correctly; only the INI-based policy mechanism is broken.
Affected products
- SumatraPDF SumatraPDF 3.6.1 and earlier
Timeline
- 2026-07-30: disclosed: GitHub security advisory GHSA-crhm-w5qr-wjj4 published
- 2026-10-08: disclosed: CVE-2026-107735 published