CVE-2026-46529: MATE Atril and GNOME Evince argument injection in ev_spawn

CVE-2026-46529 · Severity: info · CVSS 8.4 · Published 2026-06-10

Atril, Evince, and Xreader are document viewers used in popular Linux desktop environments like MATE, GNOME, and Linux Mint. A security flaw allows an attacker to take full control of a user's computer if the user clicks a link inside a specially crafted PDF document. This could lead to the theft of personal files, installation of malware, or complete system compromise.

Technologies: Linux Mint Xreader. Vendors: Gnome, Linux Mint.

Quick answers

Is CVE-2026-46529 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-46529 being exploited in the wild.
How severe is CVE-2026-46529?
Informational severity, with a CVSS score of 8.4, published 10 June 2026.
Which products and versions are affected?
Gnome Evince < 48.4; Linux Mint Xreader < 4.6.4, < 3.6.7; MATE Atril < 1.26.3, < 1.28.4.
Is there a fix for CVE-2026-46529?
A patch was published on 2026-05-15: Atril releases 1.26.3 and 1.28.4 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-46529 attacked?
It is attacked with local access, in a network appliance.
Am I affected by CVE-2026-46529?
Check whether you run Gnome Evince, Linux Mint Xreader or MATE Atril at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

An argument injection vulnerability exists in the `ev_spawn` function within `shell/ev-application.c`. The application fails to sanitize or quote user-controlled strings from PDF link-destination fields (such as `/GoToR` actions) before building a command line. When this command line is processed by `g_app_info_create_from_commandline`, it is shell-parsed, allowing an attacker to inject the `--gtk-module` argument. By delivering a polyglot file that is both a valid PDF and a valid ELF shared library, an attacker can force the application to `dlopen()` the malicious file and execute arbitrary code via a library constructor. This issue is fixed in Atril 1.26.3/1.28.4, Evince 48.4, and Xreader 4.6.4/3.6.7.

Affected products

  • MATE Desktop Atril < 1.26.3, < 1.28.4
  • GNOME Evince < 48.4
  • Linux Mint Xreader < 4.6.4, < 3.6.7

Timeline

  • 2026-05-15: patched: Atril releases 1.26.3 and 1.28.4
  • 2026-05-19: disclosed: Initial public disclosure on oss-security mailing list
  • 2026-05-21: advisory: Detailed security advisory and PoC published
  • 2026-06-10: other: CVE record published to NVD dataset

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.