Skip to content
OpenAdvisories
High · 8.4 Public exploit CVE-2026-46529 EUVD-2026-36109

PDF /GoToR action argv injection enables single-click RCE via --gtk-module dlopen

Published Jun 10, 2026 · Updated Jul 28, 2026 · Assigned by GitHub_M

Vendor: mate-desktop Product: atril Package: atril Package: atril Package: atril Package: evince Package: evince Package: evince Package: evince-gtk3 Package: evince-gtk3 Package: papers Package: papers Ecosystem: Alpine Ecosystem: Debian Ecosystem: Ubuntu

Description

Atril Document Viewer is the default document reader of the MATE desktop environment for Linux. A single-click remote code execution vulnerability in versions prior to 1.26.3 and 1.28.4 allows an attacker to achieve arbitrary code execution as the user by tricking them into clicking a link inside a malicious PDF document. The PDF can be packaged as a polyglot file that is simultaneously a valid PDF and a valid ELF shared library, making the attack a single-file, single-click, configuration-independent RCE on stock atril installations. The root cause is `shell/ev-application.c:ev_spawn`, which builds a command line from attacker-controlled PDF link-destination fields without applying `g_shell_quote`. The cmdline is then handed to `g_app_info_create_from_commandline`, which shell-parses it back into argv — splitting any embedded `--gtk-module=PATH` into a separate argv element. GTK then `dlopen()`s the path during init, running any `__attribute__((constructor))` it finds. Versions 1.26.3 and 1.28.4 contain a patch for the issue. This is the same defect class as CVE-2023-51698 (CBT `--checkpoint-action` injection in `comics-document.c`, fixed in 1.6.2) but in a different code path (`shell/ev-application.c`) that the original patch did not touch.

Affected products

VendorProductAffectedFixed
mate-desktop atril < 1.26.3, >= 1.27.0, < 1.28.4 —

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

Debian

Security tracker ↗
ReleasePackageFixed inAdvisory
Debian 14 atril 1.28.4-1 —
Debian 14 evince-gtk3 48.4+dfsg-1 —
Debian 14 papers 49.3-3 —
Debian 13 atril 1.26.2-4+deb13u1 —
Debian 13 evince 48.1-3+deb13u1 —
Debian 13 papers No fix yet —
Debian 12 atril 1.26.0-2+deb12u4 —
Debian 12 evince 43.1-2+deb12u1 —

Ubuntu

Security tracker ↗
ReleasePackageFixed inAdvisory
Ubuntu 26.10 evince-gtk3 No fix yet —
Ubuntu 26.04 LTS evince 49~alpha-2ubuntu2.1 —
Ubuntu 26.04 LTS evince-gtk3 No fix yet —
Ubuntu 26.04 LTS papers 50.1-0ubuntu1.1 —
Ubuntu 25.10 atril No fix yet —
Ubuntu 25.10 evince 48.1-3ubuntu2.1 —
Ubuntu 25.10 papers 48.0-1ubuntu1.25.10.4 —
Ubuntu 24.04 LTS evince 46.3.1-0ubuntu1.1 —
Ubuntu 22.04 LTS evince 42.3-0ubuntu3.2 —
Show 9 more (older releases, extended support, other products)
ReleasePackageFixed inAdvisory
Ubuntu 20.04 LTS evince No fix yet —
Ubuntu 18.04 LTS evince No fix yet —
Ubuntu 16.04 LTS evince No fix yet —
Ubuntu Pro 26.04 LTS atril 1.28.2-1ubuntu0.1~esm1 USN-8839-1
Ubuntu Pro 24.04 LTS atril 1.26.2-3ubuntu0.1~esm1 USN-8839-1
Ubuntu Pro 22.04 LTS atril 1.26.0-1ubuntu1.2+esm1 USN-8839-1
Ubuntu Pro 20.04 LTS atril 1.24.0-1ubuntu0.2+esm1 USN-8839-1
Ubuntu Pro 18.04 LTS atril 1.20.1-2ubuntu2+esm3 USN-8839-1
Ubuntu Pro 16.04 LTS atril 1.12.2-1ubuntu0.3+esm1 USN-8839-1

Red Hat

Security tracker ↗
ReleasePackageFixed inAdvisory
RHEL 9 evince +4 40.5-4.el9_8.1 RHSA-2026:27819
RHEL 8 evince +4 3.28.4-17.el8_10 RHSA-2026:28998
Show 10 more (older releases, extended support, other products)
ReleasePackageFixed inAdvisory
RHEL 9.6 EUS evince +4 40.5-2.el9_6.1 RHSA-2026:33169
RHEL 9.4 E4S evince +4 40.5-2.el9_4.1 RHSA-2026:33416
RHEL 9.2 E4S evince +4 40.5-2.el9_2.1 RHSA-2026:39115
RHEL 8.8 TUS evince +3 3.28.4-16.el8_8.1 RHSA-2026:42692
RHEL 8.8 E4S evince +3 3.28.4-16.el8_8.1 RHSA-2026:42692
RHEL 8.6 EUS Long Life evince +3 3.28.4-16.el8_6.1 RHSA-2026:46467
RHEL 8.6 AUS evince +3 3.28.4-16.el8_6.1 RHSA-2026:46467
RHEL 8.4 EUS Long Life evince +3 3.28.4-11.el8_4.1 RHSA-2026:43398
RHEL 8.4 AUS evince +3 3.28.4-11.el8_4.1 RHSA-2026:43398
RHEL 7 ELS evince +5 3.28.2-11.el7_9 RHSA-2026:41904

AlmaLinux

Errata ↗
ReleasePackageFixed inAdvisory
AlmaLinux 9 evince +4 40.5-4.el9_8.1 ALSA-2026:27819
AlmaLinux 8 evince +4 3.28.4-17.el8_10 ALSA-2026:28998

Rocky Linux

Errata ↗
ReleasePackageFixed inAdvisory
Rocky Linux 9 evince 40.5-4.el9_8.1 RLSA-2026:27819
Rocky Linux 8 evince 3.28.4-17.el8_10 RLSA-2026:28998

SUSE

Security tracker ↗
ReleasePackageFixed inAdvisory
SLES for SAP 16.0 papers 48.10-160000.1.1 SUSE-SU-2026:22182-1
SLES 16.0 papers 48.10-160000.1.1 SUSE-SU-2026:22182-1

openSUSE

Security tracker ↗
ReleasePackageFixed inAdvisory
openSUSE Tumbleweed papers 50.1-2.1 openSUSE-SU-2026:10853-1
openSUSE Tumbleweed xreader 4.6.5-1.1 openSUSE-SU-2026:11163-1
openSUSE Leap 16.0 papers 48.10-160000.1.1 openSUSE-SU-2026:21106-1

Alpine

Security tracker ↗
ReleasePackageFixed inAdvisory
Alpine v3.24 atril 1.28.0-r3 —
Alpine v3.24 evince 48.4-r0 —
Alpine v3.23 atril 1.28.0-r2 —
Alpine v3.23 evince 48.4-r0 —

Amazon Linux

ReleasePackageFixed inAdvisory
Amazon Linux 2023 papers +5 47.0-12.amzn2023 ALAS2023-2026-1782
Amazon Linux 2 evince +5 3.28.2-10.amzn2.0.1 ALAS2-2026-3354

Oracle Linux

ReleasePackageFixed inAdvisory
Oracle Linux 9 evince +4 40.5-4.el9_8.1 ELSA-2026-27819
Oracle Linux 8 evince +4 3.28.4-17.el8_10 ELSA-2026-28998
Oracle Linux 7 evince +5 3.28.2-10.0.1.el7 ELSA-2026-41904

Public exploits

Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.

Third-party code, not reviewed by us. Public PoCs are sometimes fake or contain malware. Read the code first and run it only in an isolated lab, against systems you are authorised to test.

GitHub 1 repository

  • N1et/CVE-2026-46529 ★ 13 · May 16, 2026

    Evince/xreader/Atril RCE exploit to CVE-2026-46529

Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.

Advisories 25

References