Junglewise Threat Intelligence

CVE-2026-46529: MATE Atril and GNOME Evince argument injection in ev_spawn

CVE-2026-46529 · Severity: info · CVSS 8.4 · Published 2026-06-10

Vendors: Gnome.

Executive brief

Atril, Evince, and Xreader are document viewers used in popular Linux desktop environments like MATE, GNOME, and Linux Mint. A security flaw allows an attacker to take full control of a user's computer if the user clicks a link inside a specially crafted PDF document. This could lead to the theft of personal files, installation of malware, or complete system compromise.

Technical details

An argument injection vulnerability exists in the `ev_spawn` function within `shell/ev-application.c`. The application fails to sanitize or quote user-controlled strings from PDF link-destination fields (such as `/GoToR` actions) before building a command line. When this command line is processed by `g_app_info_create_from_commandline`, it is shell-parsed, allowing an attacker to inject the `--gtk-module` argument. By delivering a polyglot file that is both a valid PDF and a valid ELF shared library, an attacker can force the application to `dlopen()` the malicious file and execute arbitrary code via a library constructor. This issue is fixed in Atril 1.26.3/1.28.4, Evince 48.4, and Xreader 4.6.4/3.6.7.

Affected products

  • MATE Desktop Atril < 1.26.3, < 1.28.4
  • GNOME Evince < 48.4
  • Linux Mint Xreader < 4.6.4, < 3.6.7

Timeline

  • 2026-05-15: patched: Atril releases 1.26.3 and 1.28.4
  • 2026-05-19: disclosed: Initial public disclosure on oss-security mailing list
  • 2026-05-21: advisory: Detailed security advisory and PoC published
  • 2026-06-10: other: CVE record published to NVD dataset

References

Related threats