Skip to content
Fencer Vulns
high 7.8

CVE-2026-46529 json

PDF /GoToR action argv injection enables single-click RCE via --gtk-module dlopen

published 2026-06-10 4 mo ago modified 2026-10-26 14 d ago also EUVD-2026-36109

cvss
7.8
version 3.1, CNA
cisa kev
Not listed
not in CISA's catalog
epss
0.5%
EPSS 0.5% chance of exploitation in 30 days, percentile 45%
public exploits
0
none known

Summary

Atril Document Viewer is the default document reader of the MATE desktop environment for Linux. A single-click remote code execution vulnerability in versions prior to 1.26.3 and 1.28.4 allows an attacker to achieve arbitrary code execution as the user by tricking them into clicking a link inside a malicious PDF document. The PDF can be packaged as a polyglot file that is simultaneously a valid PDF and a valid ELF shared library, making the attack a single-file, single-click, configuration-independent RCE on stock atril installations. The root cause is `shell/ev-application.c:ev_spawn`, which builds a command line from attacker-controlled PDF link-destination fields without applying `g_shell_quote`. The cmdline is then handed to `g_app_info_create_from_commandline`, which shell-parses it back into argv — splitting any embedded `--gtk-module=PATH` into a separate argv element. GTK then `dlopen()`s the path during init, running any `__attribute__((constructor))` it finds. Versions 1.26.3 and 1.28.4 contain a patch for the issue. This is the same defect class as CVE-2023-51698 (CBT `--checkpoint-action` injection in `comics-document.c`, fixed in 1.6.2) but in a different code path (`shell/ev-application.c`) that the original patch did not touch.

Patch / fix

  • Red Hat Red Hat Enterprise Linux 7 Extended Lifecycle Support 0:3.28.2-11.el7_9
  • Red Hat Red Hat Enterprise Linux 8 0:3.28.4-17.el8_10
  • Red Hat Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support 0:3.28.4-11.el8_4.1
  • Red Hat Red Hat Enterprise Linux 8.4 Extended Update Support Long-Life Add-On 0:3.28.4-11.el8_4.1
  • Red Hat Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support 0:3.28.4-16.el8_6.1
  • Red Hat Red Hat Enterprise Linux 8.6 Extended Update Support Long-Life Add-On 0:3.28.4-16.el8_6.1
  • Red Hat Red Hat Enterprise Linux 8.8 Telecommunications Update Service 0:3.28.4-16.el8_8.1
  • Red Hat Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions 0:3.28.4-16.el8_8.1
  • Red Hat Red Hat Enterprise Linux 9 0:40.5-4.el9_8.1
  • Red Hat Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions 0:40.5-2.el9_2.1
  • Red Hat Red Hat Enterprise Linux 9.4 Update Services for SAP Solutions 0:40.5-2.el9_4.1
  • Red Hat Red Hat Enterprise Linux 9.6 Extended Update Support 0:40.5-2.el9_6.1
  • atril Debian 12 1.26.0-2+deb12u4
  • atril Debian 13 1.26.2-4+deb13u1
  • atril Debian 14 1.28.4-1
  • evince Debian 12 43.1-2+deb12u1
  • evince Debian 13 48.1-3+deb13u1
  • papers Debian 14 49.3-3
  • evince-gtk3 Debian 14 48.4+dfsg-1

debian advisories DEBIAN-CVE-2026-46529

  • evince Ubuntu 22.04 LTS 42.3-0ubuntu3.2
  • evince Ubuntu 24.04 LTS 46.3.1-0ubuntu1.1
  • evince Ubuntu 25.10 48.1-3ubuntu2.1
  • evince Ubuntu 26.04 LTS 49~alpha-2ubuntu2.1
  • papers Ubuntu 25.10 48.0-1ubuntu1.25.10.4
  • papers Ubuntu 26.04 LTS 50.1-0ubuntu1.1
  • atril Ubuntu Pro 18.04 LTS 1.20.1-2ubuntu2+esm3
  • atril Ubuntu Pro 20.04 LTS 1.24.0-1ubuntu0.2+esm1

ubuntu advisories UBUNTU-CVE-2026-46529

Ubuntu security data © Canonical Ltd., from https://github.com/canonical/ubuntu-security-notices via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

  • evince RHEL 8 3.28.4-17.el8_10
  • evince-libs RHEL 8 3.28.4-17.el8_10
  • evince-nautilus RHEL 8 3.28.4-17.el8_10
  • evince-browser-plugin RHEL 8 3.28.4-17.el8_10
  • evince RHEL 9 40.5-4.el9_8.1
  • evince-libs RHEL 9 40.5-4.el9_8.1
  • evince-nautilus RHEL 9 40.5-4.el9_8.1
  • evince-previewer RHEL 9 40.5-4.el9_8.1

red hat advisories RHSA-2026:46467RHSA-2026:43398RHSA-2026:42692RHSA-2026:41904RHSA-2026:39115RHSA-2026:33416

  • papers SLES for SAP applications 16.0, SLES 16.0 48.10-160000.1.1

suse advisories SUSE-SU-2026:22182-1

  • xreader openSUSE Tumbleweed 4.6.5-1.1
  • papers openSUSE Leap 16.0 48.10-160000.1.1
  • papers openSUSE Tumbleweed 50.1-2.1

opensuse advisories openSUSE-SU-2026:11163-1openSUSE-SU-2026:21106-1openSUSE-SU-2026:10853-1

  • evince AlmaLinux 8 3.28.4-17.el8_10
  • evince-libs AlmaLinux 8 3.28.4-17.el8_10
  • evince-nautilus AlmaLinux 8 3.28.4-17.el8_10
  • evince-browser-plugin AlmaLinux 8 3.28.4-17.el8_10
  • evince AlmaLinux 9 40.5-4.el9_8.1
  • evince-libs AlmaLinux 9 40.5-4.el9_8.1
  • evince-nautilus AlmaLinux 9 40.5-4.el9_8.1
  • evince-previewer AlmaLinux 9 40.5-4.el9_8.1

almalinux advisories ALSA-2026:28998ALSA-2026:27819

  • evince Rocky Linux 8 3.28.4-17.el8_10
  • evince Rocky Linux 9 40.5-4.el9_8.1

rocky linux advisories RLSA-2026:28998RLSA-2026:27819

  • atril Alpine 3.23 1.28.0-r2
  • atril Alpine 3.24 1.28.0-r3
  • evince Alpine 3.24, Alpine 3.23 48.4-r0

alpine advisories ALPINE-CVE-2026-46529

Alpine secdb © Alpine Linux, from https://secdb.alpinelinux.org via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2026-46529 updated cvss 7.8

atril: evince: xreader: PDF /GoToR action argv injection enables single-click RCE via --gtk-module dlopen

  • Red Hat Enterprise Linux 6 evince, evince-dvi, evince-libs
    affected: workaround, no fix planned “To mitigate this vulnerability, do not click on links inside PDF documents from untrusted or unverified sources.”
  • Red Hat Enterprise Linux AppStream (v. 8) evince 3.28.4-17.el8_10, evince-libs 3.28.4-17.el8_10, evince-nautilus 3.28.4-17.el8_10, evince-browser-plugin 3.28.4-17.el8_10
    fixed: vendor fix “To mitigate this vulnerability, do not click on links inside PDF documents from untrusted or unverified sources.” RHSA-2026:28998
  • Red Hat Enterprise Linux AppStream (v. 9) evince 40.5-4.el9_8.1, evince-libs 40.5-4.el9_8.1, evince-nautilus 40.5-4.el9_8.1, evince-previewer 40.5-4.el9_8.1, evince-thumbnailer 40.5-4.el9_8.1
    fixed: vendor fix “To mitigate this vulnerability, do not click on links inside PDF documents from untrusted or unverified sources.” RHSA-2026:27819
  • Red Hat Enterprise Linux AppStream AUS (v.8.4) evince 3.28.4-11.el8_4.1, evince-libs 3.28.4-11.el8_4.1, evince-nautilus 3.28.4-11.el8_4.1, evince-browser-plugin 3.28.4-11.el8_4.1
    fixed: vendor fix “To mitigate this vulnerability, do not click on links inside PDF documents from untrusted or unverified sources.” RHSA-2026:43398
  • Red Hat Enterprise Linux AppStream AUS (v.8.6) evince 3.28.4-16.el8_6.1, evince-libs 3.28.4-16.el8_6.1, evince-nautilus 3.28.4-16.el8_6.1, evince-browser-plugin 3.28.4-16.el8_6.1
    fixed: vendor fix “To mitigate this vulnerability, do not click on links inside PDF documents from untrusted or unverified sources.” RHSA-2026:46467
  • Red Hat Enterprise Linux AppStream E4S (v.8.8) evince 3.28.4-16.el8_8.1, evince-libs 3.28.4-16.el8_8.1, evince-nautilus 3.28.4-16.el8_8.1, evince-browser-plugin 3.28.4-16.el8_8.1
    fixed: vendor fix “To mitigate this vulnerability, do not click on links inside PDF documents from untrusted or unverified sources.” RHSA-2026:42692
  • Red Hat Enterprise Linux AppStream E4S (v.9.2) evince 40.5-2.el9_2.1, evince-libs 40.5-2.el9_2.1, evince-nautilus 40.5-2.el9_2.1, evince-previewer 40.5-2.el9_2.1, evince-thumbnailer 40.5-2.el9_2.1
    fixed: vendor fix “To mitigate this vulnerability, do not click on links inside PDF documents from untrusted or unverified sources.” RHSA-2026:39115
  • Red Hat Enterprise Linux AppStream E4S (v.9.4) evince 40.5-2.el9_4.1, evince-libs 40.5-2.el9_4.1, evince-nautilus 40.5-2.el9_4.1, evince-previewer 40.5-2.el9_4.1, evince-thumbnailer 40.5-2.el9_4.1
    fixed: vendor fix “To mitigate this vulnerability, do not click on links inside PDF documents from untrusted or unverified sources.” RHSA-2026:33416
show 6 more
  • Red Hat Enterprise Linux AppStream EUS (v.9.6) evince 40.5-2.el9_6.1, evince-libs 40.5-2.el9_6.1, evince-nautilus 40.5-2.el9_6.1, evince-previewer 40.5-2.el9_6.1, evince-thumbnailer 40.5-2.el9_6.1
    fixed: vendor fix “To mitigate this vulnerability, do not click on links inside PDF documents from untrusted or unverified sources.” RHSA-2026:33169
  • Red Hat Enterprise Linux AppStream EUS EXTENSION (v.8.4) evince 3.28.4-11.el8_4.1, evince-libs 3.28.4-11.el8_4.1, evince-nautilus 3.28.4-11.el8_4.1, evince-browser-plugin 3.28.4-11.el8_4.1
    fixed: vendor fix “To mitigate this vulnerability, do not click on links inside PDF documents from untrusted or unverified sources.” RHSA-2026:43398
  • Red Hat Enterprise Linux AppStream EUS EXTENSION (v.8.6) evince 3.28.4-16.el8_6.1, evince-libs 3.28.4-16.el8_6.1, evince-nautilus 3.28.4-16.el8_6.1, evince-browser-plugin 3.28.4-16.el8_6.1
    fixed: vendor fix “To mitigate this vulnerability, do not click on links inside PDF documents from untrusted or unverified sources.” RHSA-2026:46467
  • Red Hat Enterprise Linux AppStream TUS (v.8.8) evince 3.28.4-16.el8_8.1, evince-libs 3.28.4-16.el8_8.1, evince-nautilus 3.28.4-16.el8_8.1, evince-browser-plugin 3.28.4-16.el8_8.1
    fixed: vendor fix “To mitigate this vulnerability, do not click on links inside PDF documents from untrusted or unverified sources.” RHSA-2026:42692
  • Red Hat Enterprise Linux CRB (v. 8) evince-devel 3.28.4-17.el8_10, evince-debuginfo 3.28.4-17.el8_10, evince-debugsource 3.28.4-17.el8_10, evince-libs-debuginfo 3.28.4-17.el8_10, evince-nautilus-debuginfo 3.28.4-17.el8_10, evince-browser-plugin-debuginfo 3.28.4-17.el8_10
    fixed: vendor fix “To mitigate this vulnerability, do not click on links inside PDF documents from untrusted or unverified sources.” RHSA-2026:28998
  • Red Hat Enterprise Linux Server (v. 7 ELS) evince 3.28.2-11.el7_9, evince-dvi 3.28.2-11.el7_9, evince-libs 3.28.2-11.el7_9, evince-nautilus 3.28.2-11.el7_9 Red Hat Enterprise Linux Server Optional (v. 7 ELS) evince-browser-plugin 3.28.2-11.el7_9
    fixed: vendor fix “To mitigate this vulnerability, do not click on links inside PDF documents from untrusted or unverified sources.” RHSA-2026:41904

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

CISA SSVC

Exploitation
Proof of concept is public
Automatable
no
Technical impact
total
Assessed
4 mo ago

Exploit prediction

0.53% chance of exploitation in the next 30 days, higher than 45% of all scored CVEs (FIRST EPSS, 2026-11-08).

Exploits and checks

  • github.com https://github.com/mate-desktop/atril/security/advisories/GHSA-vgv2-m826-8f6f referenced PoC, tagged "exploit" by a source, unverified

CVSS scores

assigned by version score vector
CNA 4.0 8.4 CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
CISA ADP 3.1 7.8 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
CNA 4.0 8.4 CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
CNA 3.1 7.8 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Affected products

  • mate-desktop atril
  • Red Hat Red Hat Enterprise Linux 7 Extended Lifecycle Support
  • Red Hat Red Hat Enterprise Linux 8
  • Red Hat Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support
  • Red Hat Red Hat Enterprise Linux 8.4 Extended Update Support Long-Life Add-On
  • Red Hat Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support
  • Red Hat Red Hat Enterprise Linux 8.6 Extended Update Support Long-Life Add-On
  • Red Hat Red Hat Enterprise Linux 8.8 Telecommunications Update Service
  • Red Hat Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions
  • Red Hat Red Hat Enterprise Linux 9
  • Red Hat Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions
  • Red Hat Red Hat Enterprise Linux 9.4 Update Services for SAP Solutions
  • Red Hat Red Hat Enterprise Linux 9.6 Extended Update Support
  • Red Hat Red Hat Enterprise Linux 6

Classification

Weakness
  • CWE-77 Improper Neutralization of Special Elements used in a Command
  • CWE-88 Improper Neutralization of Argument Delimiters in a Command
  • CWE-829 Inclusion of Functionality from Untrusted Control Sphere

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.

CPEs and fixed versions use Anchore's correction of NVD's data: Added CPE configurations because not yet analyzed by NVD.