Executive brief
Atril, Evince, and Xreader are document viewers used in popular Linux desktop environments like MATE, GNOME, and Linux Mint. A security flaw allows an attacker to take full control of a user's computer if the user clicks a link inside a specially crafted PDF document. This could lead to the theft of personal files, installation of malware, or complete system compromise.
Technical details
An argument injection vulnerability exists in the `ev_spawn` function within `shell/ev-application.c`. The application fails to sanitize or quote user-controlled strings from PDF link-destination fields (such as `/GoToR` actions) before building a command line. When this command line is processed by `g_app_info_create_from_commandline`, it is shell-parsed, allowing an attacker to inject the `--gtk-module` argument. By delivering a polyglot file that is both a valid PDF and a valid ELF shared library, an attacker can force the application to `dlopen()` the malicious file and execute arbitrary code via a library constructor. This issue is fixed in Atril 1.26.3/1.28.4, Evince 48.4, and Xreader 4.6.4/3.6.7.
Affected products
- MATE Desktop Atril < 1.26.3, < 1.28.4
- GNOME Evince < 48.4
- Linux Mint Xreader < 4.6.4, < 3.6.7
Timeline
- 2026-05-15: patched: Atril releases 1.26.3 and 1.28.4
- 2026-05-19: disclosed: Initial public disclosure on oss-security mailing list
- 2026-05-21: advisory: Detailed security advisory and PoC published
- 2026-06-10: other: CVE record published to NVD dataset
References
- https://github.com/mate-desktop/atril/releases/tag/v1.26.3
- https://github.com/mate-desktop/atril/releases/tag/v1.28.4
- https://github.com/mate-desktop/atril/security/advisories/GHSA-vgv2-m826-8f6f
- http://www.openwall.com/lists/oss-security/2026/05/19/34
- http://www.openwall.com/lists/oss-security/2026/05/21/7
- http://www.openwall.com/lists/oss-security/2026/05/22/11
- https://lists.debian.org/debian-lts-announce/2026/05/msg00041.html