{"id":"CVE-2026-107732","summary":"SumatraPDF: Markup/command-link injection into UI notification text","details":"SumatraPDF is a multi-format reader for Windows. In 3.6.1 and earlier, untrusted document paths and PDF link targets are interpolated into notification text that ParseTip() interprets as trusted tip markup. When a user clicks an injected link, ExecuteTipLink() dispatches its CmdExec command and can execute an attacker-selected local program in the user's context. No broader impact is claimed beyond the advisory-supported conditions. No fixed version is available as of this review.","aliases":["GHSA-2wv2-qm2f-vmxh"],"modified":"2026-10-10T07:07:06.005679874Z","published":"2026-10-08T22:22:11.879Z","database_specific":{"cwe_ids":["CWE-94"],"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/107xxx/CVE-2026-107732.json","cna_assigner":"GitHub_M"},"references":[{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/107xxx/CVE-2026-107732.json"},{"type":"ADVISORY","url":"https://github.com/sumatrapdfreader/sumatrapdf/security/advisories/GHSA-2wv2-qm2f-vmxh"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-107732"},{"type":"FIX","url":"https://github.com/sumatrapdfreader/sumatrapdf/commit/8b680387ed69e3504ef296e09d6e032f81076af8"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/sumatrapdfreader/sumatrapdf","events":[{"introduced":"0"},{"fixed":"8b680387ed69e3504ef296e09d6e032f81076af8"}],"database_specific":{"extracted_events":[{"introduced":"0"},{"last_affected":"3.6.1"}],"source":["AFFECTED_FIELD","REFERENCES"]}}],"versions":["3.2","3.1.2rel","3.0split","2.5split","2.4split","2.3split","2.2split","2.1split","2.0split","1.9split","1.8split","1.7split","1.6split","1.5split","1.4split"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-107732.json","vanir_signatures":[{"deprecated":false,"digest":{"function_hash":"152052677909956323306049876772876519978","length":297},"id":"CVE-2026-107732-32b818fc","signature_type":"Function","signature_version":"v1","source":"https://github.com/sumatrapdfreader/sumatrapdf/commit/8b680387ed69e3504ef296e09d6e032f81076af8","target":{"file":"src/SumatraPDF.cpp","function":"ShowFileNotFound"}},{"signature_version":"v1","source":"https://github.com/sumatrapdfreader/sumatrapdf/commit/8b680387ed69e3504ef296e09d6e032f81076af8","target":{"file":"src/SumatraPDF.cpp","function":"ShowPageInfoIfWanted"},"deprecated":false,"digest":{"function_hash":"53658822908558999446671299014504109132","length":471},"id":"CVE-2026-107732-6763f6af","signature_type":"Function"},{"id":"CVE-2026-107732-6cd4f271","signature_type":"Function","signature_version":"v1","source":"https://github.com/sumatrapdfreader/sumatrapdf/commit/8b680387ed69e3504ef296e09d6e032f81076af8","target":{"file":"src/Notifications.cpp","function":"NotificationWnd::Layout"},"deprecated":false,"digest":{"length":4333,"function_hash":"334914124161103765971475634123398322334"}},{"signature_version":"v1","source":"https://github.com/sumatrapdfreader/sumatrapdf/commit/8b680387ed69e3504ef296e09d6e032f81076af8","target":{"file":"src/SumatraPDF.cpp","function":"OnDocumentVerticalScrollIntent"},"deprecated":false,"digest":{"function_hash":"153022785568229873650403825863487613224","length":898},"id":"CVE-2026-107732-74394b16","signature_type":"Function"},{"source":"https://github.com/sumatrapdfreader/sumatrapdf/commit/8b680387ed69e3504ef296e09d6e032f81076af8","target":{"file":"src/SumatraPDF.cpp","function":"ShowSavedAnnotationsNotification"},"deprecated":false,"digest":{"function_hash":"29993296580763742145851008512135909068","length":289},"id":"CVE-2026-107732-75b9072b","signature_type":"Function","signature_version":"v1"},{"deprecated":false,"digest":{"length":1553,"function_hash":"118794994138944237460924502559194743475"},"id":"CVE-2026-107732-7c47dadc","signature_type":"Function","signature_version":"v1","source":"https://github.com/sumatrapdfreader/sumatrapdf/commit/8b680387ed69e3504ef296e09d6e032f81076af8","target":{"file":"src/AppUnitTests.cpp","function":"ParseTip_UnitTests"}},{"source":"https://github.com/sumatrapdfreader/sumatrapdf/commit/8b680387ed69e3504ef296e09d6e032f81076af8","target":{"file":"src/AppUnitTests.cpp"},"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["205274400720552888688252080851573969391","31199437974212336516709761210584869506","189041440358791068696217696772771550358","280794385931901628775826217471595016316"]},"id":"CVE-2026-107732-7d3d8a2f","signature_type":"Line","signature_version":"v1"},{"id":"CVE-2026-107732-82245846","signature_type":"Line","signature_version":"v1","source":"https://github.com/sumatrapdfreader/sumatrapdf/commit/8b680387ed69e3504ef296e09d6e032f81076af8","target":{"file":"src/SumatraPDF.cpp"},"deprecated":false,"digest":{"line_hashes":["270024762229860754198116842750898404407","304236950951288537178462019131113992073","206077164536714625274818802672366659825","12210962308395471598257409259056223136","252442948610815946104137799421896971607","74722307503494491808436709274178218829","115994885222966853530191678923421083110","259269480863422564444479193919860004766","316311743202675942305829952476492683245","93965221266835520736699351801881868268","119812638377823451157467578484244510813","210600999630854131328615531463426814095","52560518515854468766236241145993264293","304075033145036659483771204594316944228","137774503214493941804662001845389427515","287150043124668232047257123855930213949","8039976095025362432367713242211103766","275296742837871952241290722034383222633","323053495155455880632445723366944871429","183566083465391035835117494593169209841","253268847303151454862439742355175945943","327752343081292151865239102877299936344","235571715752283205946898216683863389630","90681290301067858590462230259434768339","304127205847810435789838621711353550998","201585153417820168357123625432209778658","192153814377480383407098066373850114659","56887457177216944993192598578880865845","242148928428928564980682726897174874544","112683339976184299485083684463113787640","146141786076894853247102139656094353210","331875047499104705063419745228934907365","182347213422389262210188121026891769227","312259323666895764169722773973717852195","33189357667189679869911173388046899066","73647125606862269522165479182480455074","75062479125324642196055376688001341079","315232508200002509798118009849702933757","53814824351694293991421209591768781356","208567508526484459550520876030806706615"],"threshold":0.9}},{"target":{"file":"src/wingui/VirtCtrl.h"},"deprecated":false,"digest":{"line_hashes":["105574011292732613933121261024426285324","112076188090489339394365849475977021924","99421435637547294575355715082413278679","219116184908378523025770633523790445307"],"threshold":0.9},"id":"CVE-2026-107732-a14c4715","signature_type":"Line","signature_version":"v1","source":"https://github.com/sumatrapdfreader/sumatrapdf/commit/8b680387ed69e3504ef296e09d6e032f81076af8"},{"digest":{"function_hash":"33501094055701439520770408550958015370","length":2291},"id":"CVE-2026-107732-a2e07a7f","signature_type":"Function","signature_version":"v1","source":"https://github.com/sumatrapdfreader/sumatrapdf/commit/8b680387ed69e3504ef296e09d6e032f81076af8","target":{"file":"src/SearchAndDDE.cpp","function":"ShowForwardSearchResult"},"deprecated":false},{"source":"https://github.com/sumatrapdfreader/sumatrapdf/commit/8b680387ed69e3504ef296e09d6e032f81076af8","target":{"file":"src/Notifications.cpp","function":"NotificationWnd::Create"},"deprecated":false,"digest":{"function_hash":"287735143735722933298977328269595103815","length":1564},"id":"CVE-2026-107732-bf9f4b44","signature_type":"Function","signature_version":"v1"},{"id":"CVE-2026-107732-c047605f","signature_type":"Function","signature_version":"v1","source":"https://github.com/sumatrapdfreader/sumatrapdf/commit/8b680387ed69e3504ef296e09d6e032f81076af8","target":{"function":"ShowErrorLoadingNotification","file":"src/SumatraPDF.cpp"},"deprecated":false,"digest":{"function_hash":"137009320478256171500423638122397756601","length":363}},{"digest":{"threshold":0.9,"line_hashes":["230191304284408838718900057136446848885","219816870151563690762546043291803220496","236954229332814721255921860370790237879","164653486560983063737321722201166809188"]},"id":"CVE-2026-107732-cfd1e510","signature_type":"Line","signature_version":"v1","source":"https://github.com/sumatrapdfreader/sumatrapdf/commit/8b680387ed69e3504ef296e09d6e032f81076af8","target":{"file":"src/SelectionHandlers.cpp"},"deprecated":false},{"signature_version":"v1","source":"https://github.com/sumatrapdfreader/sumatrapdf/commit/8b680387ed69e3504ef296e09d6e032f81076af8","target":{"file":"src/SumatraPDF.cpp","function":"ReplaceDocumentInCurrentTab"},"deprecated":false,"digest":{"function_hash":"215535265883722698038078317000334913792","length":8263},"id":"CVE-2026-107732-dabf2ddb","signature_type":"Function"},{"signature_version":"v1","source":"https://github.com/sumatrapdfreader/sumatrapdf/commit/8b680387ed69e3504ef296e09d6e032f81076af8","target":{"file":"src/SearchAndDDE.cpp"},"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["316751197041811226253810596812131718907","25876963764713171434706690868831154196","175993096328960266137256036820291501358","189956394095700274240214959588611894963"]},"id":"CVE-2026-107732-dcbcfe04","signature_type":"Line"},{"signature_version":"v1","source":"https://github.com/sumatrapdfreader/sumatrapdf/commit/8b680387ed69e3504ef296e09d6e032f81076af8","target":{"file":"src/Notifications.cpp"},"deprecated":false,"digest":{"line_hashes":["284329577854073474242227446410243902600","257413372768742909160872149720392384122","122145952939580879992296256315337119379","136727260028395458561133084413783167380","6317412511883544886378704338561760683","258870884924570009275634150365816576190","246351313893296618084060915078769788315","89212998614851310340242957124985736965","247329859670490433852252485779048975780","18686147140049271580403873899973344522","203926976212315039957055738360135585388","151924195899164671249049075713427367705","28471307780660606462199202220296499948","267624941920328415617635076225222138096","303289893994256719564492155890878485659","242953734628379676723302738927034233278","85556822226919263089075573659760102411","182470087489666080896854322083686168108","64618728313045062207301162321876108607","269245809810859975250185368894561806988","198339468688566651234607760681799797843","159192629935908321309804270893554130995","9380033300065068259643124869145562534","50121393222701857345596695145863640267","287142579941161800926830412067392905456","73743326122359916351821861162912601033","182973468682903140744908498035713043630","246981684384055139805222481489328759286"],"threshold":0.9},"id":"CVE-2026-107732-e3498be8","signature_type":"Line"},{"deprecated":false,"digest":{"function_hash":"73196646099771551181485085612570038806","length":304},"id":"CVE-2026-107732-f850e485","signature_type":"Function","signature_version":"v1","source":"https://github.com/sumatrapdfreader/sumatrapdf/commit/8b680387ed69e3504ef296e09d6e032f81076af8","target":{"file":"src/SelectionHandlers.cpp","function":"ShowSelectionHandlerNotification"}},{"signature_version":"v1","source":"https://github.com/sumatrapdfreader/sumatrapdf/commit/8b680387ed69e3504ef296e09d6e032f81076af8","target":{"file":"src/Notifications.h"},"deprecated":false,"digest":{"line_hashes":["328631065817328583571283230888939704747","24799986408599377937476361291237950900","19428880618399051034472275320806458453","302736510084597275821704990778421054037","328119166205170696973886717445517715957","19090604358541268846530067055296108050","230211447660891706660724106126248168039","155322125981336489317217002111355700311","201103845183932875803357978144247074583","50439073378132178303493760010944243224"],"threshold":0.9},"id":"CVE-2026-107732-fd751bc1","signature_type":"Line"}],"vanir_signatures_modified":"2026-10-10T07:07:06Z"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N"}]}