{"schema":"threatline.record/2","record":{"id":"CVE-2026-107734","aliases":["GHSA-jf4v-rw66-j4w2"],"summary":"SumatraPDF: SyncTeX Argument Injection in Inverse Search Enables Arbitrary Command Execution via External Editors","details":"SumatraPDF is a multi-format reader for Windows. In 3.5.2 and earlier, an attacker-controlled SyncTeX source filename is substituted for the %f placeholder in an external editor command line without safe Windows argument quoting, and the resulting command line is passed to CreateProcessW(). A user with an external editor configured or auto-detected who opens a PDF with a crafted .synctex.gz file and invokes inverse search can inject command-line flags; the resulting impact depends on the target editor interpreting those flags and can include unintended editor actions or code execution through a malicious extension. No broader impact is claimed beyond the advisory-supported conditions. No fixed version is available as of this review.","categories":["Unclassified"],"product":"sumatrapdf","vendor":"sumatrapdfreader","ecosystem":null,"affected_ranges":[{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-107734","source_modified_at":"2026-10-09T15:44:18.411Z","fetched_at":"2026-10-23T18:48:36.087640Z","product":"sumatrapdf","vendor":"sumatrapdfreader","versions":[{"version":"<= 3.5.2","status":"affected"}],"defaultStatus":null}],"fixed_versions":[],"cvss":7.1,"severity":"High","kev":{"listed":false},"epss":{"probability":0.00141,"percentile":0.0312,"score_date":"2026-10-23"},"published_at":"2026-10-08T22:24:23.861Z","modified_at":"2026-10-09T15:44:18.411Z","provenance":[{"source":"CVE List","url":"https://www.cve.org/CVERecord?id=CVE-2026-107734","fetched_at":"2026-10-23T18:48:36.087640Z","source_modified_at":"2026-10-09T15:44:18.411Z"},{"source":"EPSS","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-107734","fetched_at":"2026-10-23T18:42:43.628194Z","source_modified_at":"2026-10-23"}],"sources":["CVE List","EPSS"],"references":[{"source":"CVE List","url":"https://github.com/sumatrapdfreader/sumatrapdf/security/advisories/GHSA-jf4v-rw66-j4w2","tags":["exploit"]},{"source":"CVE List","url":"https://github.com/sumatrapdfreader/sumatrapdf/commit/398d23624362c60722d9709173a287ea53545b3b","tags":["x_refsource_MISC"]}],"locations":[],"motoko_assessment":{"status":"requires_architecture_review","automatic_remediation":false},"cve_state":"PUBLISHED","cvss_source":"CVE List","ssvc":{"exploitation":"poc","automatable":"no","technical_impact":"total","assessed_at":"2026-10-09T15:44:08.862536Z"},"classification":{"method":"product-first software-layer rules","rules_version":"2.1","matched_on":null,"confidence":"unknown","reviewed":false},"change_timestamp":"2026-10-09T15:44:18.411Z","content_hash":"66fd10ac16d520b97eabb41e65981fb26ef701eebd1178e65c2889df1ff9ac6e"}}