CVE-2026-107732

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-107732
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-107732.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-107732
Aliases
  • GHSA-2wv2-qm2f-vmxh
Published
2026-10-08T22:22:11Z
Modified
2026-10-10T07:07:06Z
Severity
  • 8.4 (High) CVSS_V4 - CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N CVSS Calculator
Summary
SumatraPDF: Markup/command-link injection into UI notification text
Details

SumatraPDF is a multi-format reader for Windows. In 3.6.1 and earlier, untrusted document paths and PDF link targets are interpolated into notification text that ParseTip() interprets as trusted tip markup. When a user clicks an injected link, ExecuteTipLink() dispatches its CmdExec command and can execute an attacker-selected local program in the user's context. No broader impact is claimed beyond the advisory-supported conditions. No fixed version is available as of this review.

Database specific 
{
    "cna_assigner": "GitHub_M",
    "cwe_ids": [
        "CWE-94"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/107xxx/CVE-2026-107732.json"
}
References

Affected packages

Git / github.com/sumatrapdfreader/sumatrapdf

Affected ranges

Type
GIT
Repo
https://github.com/sumatrapdfreader/sumatrapdf
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
8b680387ed69e3504ef296e09d6e032f81076af8
Database specific
Show details 
{
    "extracted_events": [
        {
            "introduced": "0"
        },
        {
            "last_affected": "3.6.1"
        }
    ],
    "source": [
        "AFFECTED_FIELD",
        "REFERENCES"
    ]
}

Affected versions

1.*
1.4split
1.5split
1.6split
1.7split
1.8split
1.9split
2.*
2.0split
2.1split
2.2split
2.3split
2.4split
2.5split
3.*
3.0split
3.1.2rel
3.2

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-107732.json"
vanir_signatures 
[
    {
        "deprecated": false,
        "digest": {
            "function_hash": "152052677909956323306049876772876519978",
            "length": 297
        },
        "id": "CVE-2026-107732-32b818fc",
        "signature_type": "Function",
        "signature_version": "v1",
        "source": "https://github.com/sumatrapdfreader/sumatrapdf/commit/8b680387ed69e3504ef296e09d6e032f81076af8",
        "target": {
            "file": "src/SumatraPDF.cpp",
            "function": "ShowFileNotFound"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "function_hash": "53658822908558999446671299014504109132",
            "length": 471
        },
        "id": "CVE-2026-107732-6763f6af",
        "signature_type": "Function",
        "signature_version": "v1",
        "source": "https://github.com/sumatrapdfreader/sumatrapdf/commit/8b680387ed69e3504ef296e09d6e032f81076af8",
        "target": {
            "file": "src/SumatraPDF.cpp",
            "function": "ShowPageInfoIfWanted"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "function_hash": "334914124161103765971475634123398322334",
            "length": 4333
        },
        "id": "CVE-2026-107732-6cd4f271",
        "signature_type": "Function",
        "signature_version": "v1",
        "source": "https://github.com/sumatrapdfreader/sumatrapdf/commit/8b680387ed69e3504ef296e09d6e032f81076af8",
        "target": {
            "file": "src/Notifications.cpp",
            "function": "NotificationWnd::Layout"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "function_hash": "153022785568229873650403825863487613224",
            "length": 898
        },
        "id": "CVE-2026-107732-74394b16",
        "signature_type": "Function",
        "signature_version": "v1",
        "source": "https://github.com/sumatrapdfreader/sumatrapdf/commit/8b680387ed69e3504ef296e09d6e032f81076af8",
        "target": {
            "file": "src/SumatraPDF.cpp",
            "function": "OnDocumentVerticalScrollIntent"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "function_hash": "29993296580763742145851008512135909068",
            "length": 289
        },
        "id": "CVE-2026-107732-75b9072b",
        "signature_type": "Function",
        "signature_version": "v1",
        "source": "https://github.com/sumatrapdfreader/sumatrapdf/commit/8b680387ed69e3504ef296e09d6e032f81076af8",
        "target": {
            "file": "src/SumatraPDF.cpp",
            "function": "ShowSavedAnnotationsNotification"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "function_hash": "118794994138944237460924502559194743475",
            "length": 1553
        },
        "id": "CVE-2026-107732-7c47dadc",
        "signature_type": "Function",
        "signature_version": "v1",
        "source": "https://github.com/sumatrapdfreader/sumatrapdf/commit/8b680387ed69e3504ef296e09d6e032f81076af8",
        "target": {
            "file": "src/AppUnitTests.cpp",
            "function": "ParseTip_UnitTests"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "line_hashes": [
                "205274400720552888688252080851573969391",
                "31199437974212336516709761210584869506",
                "189041440358791068696217696772771550358",
                "280794385931901628775826217471595016316"
            ],
            "threshold": 0.9
        },
        "id": "CVE-2026-107732-7d3d8a2f",
        "signature_type": "Line",
        "signature_version": "v1",
        "source": "https://github.com/sumatrapdfreader/sumatrapdf/commit/8b680387ed69e3504ef296e09d6e032f81076af8",
        "target": {
            "file": "src/AppUnitTests.cpp"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "line_hashes": [
                "270024762229860754198116842750898404407",
                "304236950951288537178462019131113992073",
                "206077164536714625274818802672366659825",
                "12210962308395471598257409259056223136",
                "252442948610815946104137799421896971607",
                "74722307503494491808436709274178218829",
                "115994885222966853530191678923421083110",
                "259269480863422564444479193919860004766",
                "316311743202675942305829952476492683245",
                "93965221266835520736699351801881868268",
                "119812638377823451157467578484244510813",
                "210600999630854131328615531463426814095",
                "52560518515854468766236241145993264293",
                "304075033145036659483771204594316944228",
                "137774503214493941804662001845389427515",
                "287150043124668232047257123855930213949",
                "8039976095025362432367713242211103766",
                "275296742837871952241290722034383222633",
                "323053495155455880632445723366944871429",
                "183566083465391035835117494593169209841",
                "253268847303151454862439742355175945943",
                "327752343081292151865239102877299936344",
                "235571715752283205946898216683863389630",
                "90681290301067858590462230259434768339",
                "304127205847810435789838621711353550998",
                "201585153417820168357123625432209778658",
                "192153814377480383407098066373850114659",
                "56887457177216944993192598578880865845",
                "242148928428928564980682726897174874544",
                "112683339976184299485083684463113787640",
                "146141786076894853247102139656094353210",
                "331875047499104705063419745228934907365",
                "182347213422389262210188121026891769227",
                "312259323666895764169722773973717852195",
                "33189357667189679869911173388046899066",
                "73647125606862269522165479182480455074",
                "75062479125324642196055376688001341079",
                "315232508200002509798118009849702933757",
                "53814824351694293991421209591768781356",
                "208567508526484459550520876030806706615"
            ],
            "threshold": 0.9
        },
        "id": "CVE-2026-107732-82245846",
        "signature_type": "Line",
        "signature_version": "v1",
        "source": "https://github.com/sumatrapdfreader/sumatrapdf/commit/8b680387ed69e3504ef296e09d6e032f81076af8",
        "target": {
            "file": "src/SumatraPDF.cpp"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "line_hashes": [
                "105574011292732613933121261024426285324",
                "112076188090489339394365849475977021924",
                "99421435637547294575355715082413278679",
                "219116184908378523025770633523790445307"
            ],
            "threshold": 0.9
        },
        "id": "CVE-2026-107732-a14c4715",
        "signature_type": "Line",
        "signature_version": "v1",
        "source": "https://github.com/sumatrapdfreader/sumatrapdf/commit/8b680387ed69e3504ef296e09d6e032f81076af8",
        "target": {
            "file": "src/wingui/VirtCtrl.h"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "function_hash": "33501094055701439520770408550958015370",
            "length": 2291
        },
        "id": "CVE-2026-107732-a2e07a7f",
        "signature_type": "Function",
        "signature_version": "v1",
        "source": "https://github.com/sumatrapdfreader/sumatrapdf/commit/8b680387ed69e3504ef296e09d6e032f81076af8",
        "target": {
            "file": "src/SearchAndDDE.cpp",
            "function": "ShowForwardSearchResult"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "function_hash": "287735143735722933298977328269595103815",
            "length": 1564
        },
        "id": "CVE-2026-107732-bf9f4b44",
        "signature_type": "Function",
        "signature_version": "v1",
        "source": "https://github.com/sumatrapdfreader/sumatrapdf/commit/8b680387ed69e3504ef296e09d6e032f81076af8",
        "target": {
            "file": "src/Notifications.cpp",
            "function": "NotificationWnd::Create"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "function_hash": "137009320478256171500423638122397756601",
            "length": 363
        },
        "id": "CVE-2026-107732-c047605f",
        "signature_type": "Function",
        "signature_version": "v1",
        "source": "https://github.com/sumatrapdfreader/sumatrapdf/commit/8b680387ed69e3504ef296e09d6e032f81076af8",
        "target": {
            "file": "src/SumatraPDF.cpp",
            "function": "ShowErrorLoadingNotification"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "line_hashes": [
                "230191304284408838718900057136446848885",
                "219816870151563690762546043291803220496",
                "236954229332814721255921860370790237879",
                "164653486560983063737321722201166809188"
            ],
            "threshold": 0.9
        },
        "id": "CVE-2026-107732-cfd1e510",
        "signature_type": "Line",
        "signature_version": "v1",
        "source": "https://github.com/sumatrapdfreader/sumatrapdf/commit/8b680387ed69e3504ef296e09d6e032f81076af8",
        "target": {
            "file": "src/SelectionHandlers.cpp"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "function_hash": "215535265883722698038078317000334913792",
            "length": 8263
        },
        "id": "CVE-2026-107732-dabf2ddb",
        "signature_type": "Function",
        "signature_version": "v1",
        "source": "https://github.com/sumatrapdfreader/sumatrapdf/commit/8b680387ed69e3504ef296e09d6e032f81076af8",
        "target": {
            "file": "src/SumatraPDF.cpp",
            "function": "ReplaceDocumentInCurrentTab"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "line_hashes": [
                "316751197041811226253810596812131718907",
                "25876963764713171434706690868831154196",
                "175993096328960266137256036820291501358",
                "189956394095700274240214959588611894963"
            ],
            "threshold": 0.9
        },
        "id": "CVE-2026-107732-dcbcfe04",
        "signature_type": "Line",
        "signature_version": "v1",
        "source": "https://github.com/sumatrapdfreader/sumatrapdf/commit/8b680387ed69e3504ef296e09d6e032f81076af8",
        "target": {
            "file": "src/SearchAndDDE.cpp"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "line_hashes": [
                "284329577854073474242227446410243902600",
                "257413372768742909160872149720392384122",
                "122145952939580879992296256315337119379",
                "136727260028395458561133084413783167380",
                "6317412511883544886378704338561760683",
                "258870884924570009275634150365816576190",
                "246351313893296618084060915078769788315",
                "89212998614851310340242957124985736965",
                "247329859670490433852252485779048975780",
                "18686147140049271580403873899973344522",
                "203926976212315039957055738360135585388",
                "151924195899164671249049075713427367705",
                "28471307780660606462199202220296499948",
                "267624941920328415617635076225222138096",
                "303289893994256719564492155890878485659",
                "242953734628379676723302738927034233278",
                "85556822226919263089075573659760102411",
                "182470087489666080896854322083686168108",
                "64618728313045062207301162321876108607",
                "269245809810859975250185368894561806988",
                "198339468688566651234607760681799797843",
                "159192629935908321309804270893554130995",
                "9380033300065068259643124869145562534",
                "50121393222701857345596695145863640267",
                "287142579941161800926830412067392905456",
                "73743326122359916351821861162912601033",
                "182973468682903140744908498035713043630",
                "246981684384055139805222481489328759286"
            ],
            "threshold": 0.9
        },
        "id": "CVE-2026-107732-e3498be8",
        "signature_type": "Line",
        "signature_version": "v1",
        "source": "https://github.com/sumatrapdfreader/sumatrapdf/commit/8b680387ed69e3504ef296e09d6e032f81076af8",
        "target": {
            "file": "src/Notifications.cpp"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "function_hash": "73196646099771551181485085612570038806",
            "length": 304
        },
        "id": "CVE-2026-107732-f850e485",
        "signature_type": "Function",
        "signature_version": "v1",
        "source": "https://github.com/sumatrapdfreader/sumatrapdf/commit/8b680387ed69e3504ef296e09d6e032f81076af8",
        "target": {
            "file": "src/SelectionHandlers.cpp",
            "function": "ShowSelectionHandlerNotification"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "line_hashes": [
                "328631065817328583571283230888939704747",
                "24799986408599377937476361291237950900",
                "19428880618399051034472275320806458453",
                "302736510084597275821704990778421054037",
                "328119166205170696973886717445517715957",
                "19090604358541268846530067055296108050",
                "230211447660891706660724106126248168039",
                "155322125981336489317217002111355700311",
                "201103845183932875803357978144247074583",
                "50439073378132178303493760010944243224"
            ],
            "threshold": 0.9
        },
        "id": "CVE-2026-107732-fd751bc1",
        "signature_type": "Line",
        "signature_version": "v1",
        "source": "https://github.com/sumatrapdfreader/sumatrapdf/commit/8b680387ed69e3504ef296e09d6e032f81076af8",
        "target": {
            "file": "src/Notifications.h"
        }
    }
]
vanir_signatures_modified 
"2026-10-10T07:07:06Z"