CVE-2026-107733 Details

A null pointer dereference vulnerability has been identified in SumatraPDF versions through 3.6.1. The issue arises in the `FrameOnCommand()` function, where the `CmdExec` command handler passes a null pointer for the current tab to the `RunWithExe()` function. This dereference of `WindowTab::filePath` can lead to a crash when no document tab is open. The vulnerability can be exploited by a local process in the same interactive Windows session, at an integrity level equal to or higher than SumatraPDF's, using DDE or `WM_COPYDATA` to dispatch commands. This exploitation causes an abrupt termination of the SumatraPDF process, resulting in the loss of unsaved work, such as pending annotation edits.

As of now, there is no fixed version available. However, the vulnerability can be addressed by adding a null check for the tab pointer in the `RunWithExe()` function, ensuring that commands are not executed when no document tab is active.