Skip to content
OpenAdvisories
High ALAS2-2026-3354 1 CVE

Important: evince security update (Amazon Linux 2)

Published Jun 8, 2026 · Updated Jun 22, 2026

Ecosystem: Amazon Linux

Summary

Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2026-46529: CVE-2026-46529 is a command injection vulnerability in Evince, Atril, and Xreader caused by missing quoting of shell-like input in ev_spawn() in ev-application.c.

Fixed packages 7

ReleasePackageFixed in
Amazon Linux · 2 evince 0:3.28.2-10.amzn2.0.1
Amazon Linux · 2 evince-browser-plugin 0:3.28.2-10.amzn2.0.1
Amazon Linux · 2 evince-debuginfo 0:3.28.2-10.amzn2.0.1
Amazon Linux · 2 evince-devel 0:3.28.2-10.amzn2.0.1
Amazon Linux · 2 evince-dvi 0:3.28.2-10.amzn2.0.1
Amazon Linux · 2 evince-libs 0:3.28.2-10.amzn2.0.1
Amazon Linux · 2 evince-nautilus 0:3.28.2-10.amzn2.0.1

Vulnerabilities 1

  • High 8.4
    CVE-2026-46529 Public exploit

    PDF /GoToR action argv injection enables single-click RCE via --gtk-module dlopen

    Atril Document Viewer is the default document reader of the MATE desktop environment for Linux. A single-click remote code execution vulnerability in versions prior to 1.26.3 and 1.28.4 allows an attacker to achieve arbitrary code execution as the user by tri…

    mate-desktop atril evince atril Debian Ubuntu Alpine

References

  • web
    https://alas.aws.amazon.com/cve/html/CVE-2026-46529.html