Skip to content
OpenAdvisories
High USN-8839-1 3 CVEs

atril vulnerabilities

Published Sep 28, 2026 · Updated Sep 28, 2026

Ecosystem: Ubuntu

Summary

It was discovered that Atril did not properly sanitize command-line
arguments in PDF /GoToR actions. If a user opened a specially crafted PDF
file, an attacker could possibly use this issue to execute arbitrary code.
(CVE-2026-46529)

It was discovered that Atril incorrectly handled certain PDF files. An
attacker could possibly use this issue to cause a denial of service or
to execute arbitrary code. This issue only affected Ubuntu 16.04 LTS.
(CVE-2019-1010006)

Andy Nguyen discovered that Atril incorrectly handled certain images. An
attacker could possibly use this issue to expose sensitive information.
This issue only affected Ubuntu 16.04 LTS. (CVE-2019-11459)

Fixed packages 6

ReleasePackageFixed in
Ubuntu · Pro 16.04 LTS Pro:16.04:LTS atril 1.12.2-1ubuntu0.3+esm1
Ubuntu · Pro 18.04 LTS Pro:18.04:LTS atril 1.20.1-2ubuntu2+esm3
Ubuntu · Pro 20.04 LTS Pro:20.04:LTS atril 1.24.0-1ubuntu0.2+esm1
Ubuntu · Pro 22.04 LTS Pro:22.04:LTS atril 1.26.0-1ubuntu1.2+esm1
Ubuntu · Pro 24.04 LTS Pro:24.04:LTS atril 1.26.2-3ubuntu0.1~esm1
Ubuntu · Pro 26.04 LTS Pro:26.04:LTS atril 1.28.2-1ubuntu0.1~esm1

Vulnerabilities 3

  • High 8.4
    CVE-2026-46529 Public exploit

    PDF /GoToR action argv injection enables single-click RCE via --gtk-module dlopen

    Atril Document Viewer is the default document reader of the MATE desktop environment for Linux. A single-click remote code execution vulnerability in versions prior to 1.26.3 and 1.28.4 allows an attacker to achieve arbitrary code execution as the user by tri…

    mate-desktop atril evince atril Debian Ubuntu Alpine
  • Unscored —
    CVE-2019-1010006

    Evince 3.26.0 is affected by buffer overflow. The impact is: DOS / Possible code execution. The component is: backend/t…

    Evince Team Evince evince atril Debian Ubuntu
  • Unscored —
    CVE-2019-11459

    The tiff_document_render() and tiff_document_get_thumbnail() functions in the TIFF document backend in GNOME Evince thr…

    evince atril atril evince Debian Ubuntu Alpine

References

  • report
    https://ubuntu.com/security/CVE-2019-11459
  • report
    https://ubuntu.com/security/CVE-2019-1010006
  • report
    https://ubuntu.com/security/CVE-2026-46529