Log in Start free

Vulnerability · Published Jun 10, 2026 · Assigned by GitHub_M

CVE-2026-46529PDF /GoToR action argv injection enables single-click RCE via --gtk-module dlopen

High 7.8

In plain English

A high-severity command injection in atril from mate-desktop. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 45% of all known vulnerabilities). Ready-made attack tooling exists: public proof-of-concept code. Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)7.8High
Exploit odds (30 days)0.5%top 55.1% of all CVEs
Exploited in the wildNo reportsCISA SSVC: poc
Attack tooling1Public PoC

Official description

Atril Document Viewer is the default document reader of the MATE desktop environment for Linux. A single-click remote code execution vulnerability in versions prior to 1.26.3 and 1.28.4 allows an attacker to achieve arbitrary code execution as the user by tricking them into clicking a link inside a malicious PDF document. The PDF can be packaged as a polyglot file that is simultaneously a valid PDF and a valid ELF shared library, making the attack a single-file, single-click, configuration-independent RCE on stock atril installations. The root cause is `shell/ev-application.c:ev_spawn`, which builds a command line from attacker-controlled PDF link-destination fields without applying `g_shell_quote`. The cmdline is then handed to `g_app_info_create_from_commandline`, which shell-parses it back into argv — splitting any embedded `--gtk-module=PATH` into a separate argv element. GTK then `dlopen()`s the path during init, running any `__attribute__((constructor))` it finds. Versions 1.26.3 and 1.28.4 contain a patch for the issue. This is the same defect class as CVE-2023-51698 (CBT `--checkpoint-action` injection in `comics-document.c`, fixed in 1.6.2) but in a different code path (`shell/ev-application.c`) that the original patch did not touch.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
AlmaLinux:8evince3.28.4-17.el8_10ALSA-2026:28998
AlmaLinux:9evince40.5-4.el9_8.1ALSA-2026:27819
AlmaLinux:8evince-browser-plugin3.28.4-17.el8_10ALSA-2026:28998
AlmaLinux:8evince-devel3.28.4-17.el8_10ALSA-2026:28998
AlmaLinux:8evince-libs3.28.4-17.el8_10ALSA-2026:28998
AlmaLinux:9evince-libs40.5-4.el9_8.1ALSA-2026:27819
AlmaLinux:8evince-nautilus3.28.4-17.el8_10ALSA-2026:28998
AlmaLinux:9evince-nautilus40.5-4.el9_8.1ALSA-2026:27819
AlmaLinux:9evince-previewer40.5-4.el9_8.1ALSA-2026:27819
AlmaLinux:9evince-thumbnailer40.5-4.el9_8.1ALSA-2026:27819
Alpine:v3.23atril1.28.0-r2ALPINE-CVE-2026-46529
Alpine:v3.24atril1.28.0-r3ALPINE-CVE-2026-46529
Alpine:v3.23evince48.4-r0ALPINE-CVE-2026-46529
Alpine:v3.24evince48.4-r0ALPINE-CVE-2026-46529
Debian:12atril1.26.0-2+deb12u4DEBIAN-CVE-2026-46529
Debian:13atril1.26.2-4+deb13u1DEBIAN-CVE-2026-46529
Debian:14atril1.28.4-1DEBIAN-CVE-2026-46529
Debian:12evince43.1-2+deb12u1DEBIAN-CVE-2026-46529
Debian:13evince48.1-3+deb13u1DEBIAN-CVE-2026-46529
Debian:14evince-gtk348.4+dfsg-1DEBIAN-CVE-2026-46529
Debian:13papersno fix listedDEBIAN-CVE-2026-46529
Debian:14papers49.3-3DEBIAN-CVE-2026-46529
Rocky Linux:8evince0:3.28.4-17.el8_10RLSA-2026:28998
Rocky Linux:9evince0:40.5-4.el9_8.1RLSA-2026:27819
Ubuntu:25.10atrilno fix listedUBUNTU-CVE-2026-46529
Ubuntu:22.04:LTSevince42.3-0ubuntu3.2UBUNTU-CVE-2026-46529
Ubuntu:24.04:LTSevince46.3.1-0ubuntu1.1UBUNTU-CVE-2026-46529
Ubuntu:25.10evince48.1-3ubuntu2.1UBUNTU-CVE-2026-46529
Ubuntu:26.04:LTSevince49~alpha-2ubuntu2.1UBUNTU-CVE-2026-46529
Ubuntu:26.04:LTSevince-gtk3no fix listedUBUNTU-CVE-2026-46529
Ubuntu:26.10evince-gtk3no fix listedUBUNTU-CVE-2026-46529
Ubuntu:25.10papers48.0-1ubuntu1.25.10.4UBUNTU-CVE-2026-46529
Ubuntu:26.04:LTSpapers50.1-0ubuntu1.1UBUNTU-CVE-2026-46529

Affected products (as reported)

VendorProductVersions
mate-desktop atril < 1.26.3>= 1.27.0, < 1.28.4

Weakness: CWE-77, CWE-88, CWE-829 · Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

References