Summary
The evince packages provide a simple multi-page document viewer for Portable Document Format (PDF), PostScript (PS), Encapsulated PostScript (EPS) files, and, with additional back-ends, also the Device Independent File format (DVI) files.
Security Fix(es):
* atril: evince: xreader: PDF /GoToR action argv injection enables single-click RCE via --gtk-module dlopen (CVE-2026-46529)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Fixed packages 5
| Release | Package | Fixed in |
|---|---|---|
| AlmaLinux · 8 | evince | 3.28.4-17.el8_10 |
| AlmaLinux · 8 | evince-browser-plugin | 3.28.4-17.el8_10 |
| AlmaLinux · 8 | evince-devel | 3.28.4-17.el8_10 |
| AlmaLinux · 8 | evince-libs | 3.28.4-17.el8_10 |
| AlmaLinux · 8 | evince-nautilus | 3.28.4-17.el8_10 |
Vulnerabilities 1
-
High 8.4CVE-2026-46529 Public exploit
PDF /GoToR action argv injection enables single-click RCE via --gtk-module dlopen
Atril Document Viewer is the default document reader of the MATE desktop environment for Linux. A single-click remote code execution vulnerability in versions prior to 1.26.3 and 1.28.4 allows an attacker to achieve arbitrary code execution as the user by tri…