# CVE-2026-46529: MATE Atril and GNOME Evince argument injection in ev_spawn

Source: https://junglewise.ai/threats/cve-2026-46529-mate-atril-and-gnome-evince-argument-injection-in-ev-spawn  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-06-10. Updated: 2026-06-10  
License: CC BY 4.0 with a link back

CVE-2026-46529 · Severity: info · CVSS 8.4 · Published 2026-06-10

Atril, Evince, and Xreader are document viewers used in popular Linux desktop environments like MATE, GNOME, and Linux Mint. A security flaw allows an attacker to take full control of a user's computer if the user clicks a link inside a specially crafted PDF document. This could lead to the theft of personal files, installation of malware, or complete system compromise.

Technologies: [Linux Mint Xreader](https://junglewise.ai/threats/technologies/xreader). Vendors: [Gnome](https://junglewise.ai/threats/vendors/gnome), [Linux Mint](https://junglewise.ai/threats/vendors/linux-mint).

## Quick answers

**Is CVE-2026-46529 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-46529 being exploited in the wild.

**How severe is CVE-2026-46529?** Informational severity, with a CVSS score of 8.4, published 10 June 2026.

**Which products and versions are affected?** Gnome Evince < 48.4; Linux Mint Xreader < 4.6.4, < 3.6.7; MATE Atril < 1.26.3, < 1.28.4.

**Is there a fix for CVE-2026-46529?** A patch was published on 2026-05-15: Atril releases 1.26.3 and 1.28.4 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-46529 attacked?** It is attacked with local access, in a network appliance.

**Am I affected by CVE-2026-46529?** Check whether you run Gnome Evince, Linux Mint Xreader or MATE Atril at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

An argument injection vulnerability exists in the `ev_spawn` function within `shell/ev-application.c`. The application fails to sanitize or quote user-controlled strings from PDF link-destination fields (such as `/GoToR` actions) before building a command line. When this command line is processed by `g_app_info_create_from_commandline`, it is shell-parsed, allowing an attacker to inject the `--gtk-module` argument. By delivering a polyglot file that is both a valid PDF and a valid ELF shared library, an attacker can force the application to `dlopen()` the malicious file and execute arbitrary code via a library constructor. This issue is fixed in Atril 1.26.3/1.28.4, Evince 48.4, and Xreader 4.6.4/3.6.7.

## Affected products

- MATE Desktop Atril < 1.26.3, < 1.28.4
- GNOME Evince < 48.4
- Linux Mint Xreader < 4.6.4, < 3.6.7

## Timeline

- 2026-05-15: patched: Atril releases 1.26.3 and 1.28.4
- 2026-05-19: disclosed: Initial public disclosure on oss-security mailing list
- 2026-05-21: advisory: Detailed security advisory and PoC published
- 2026-06-10: other: CVE record published to NVD dataset

## References

- [https://github.com/mate-desktop/atril/releases/tag/v1.26.3](https://github.com/mate-desktop/atril/releases/tag/v1.26.3)
- [https://github.com/mate-desktop/atril/releases/tag/v1.28.4](https://github.com/mate-desktop/atril/releases/tag/v1.28.4)
- [https://github.com/mate-desktop/atril/security/advisories/GHSA-vgv2-m826-8f6f](https://github.com/mate-desktop/atril/security/advisories/GHSA-vgv2-m826-8f6f)
- [http://www.openwall.com/lists/oss-security/2026/05/19/34](http://www.openwall.com/lists/oss-security/2026/05/19/34)
- [http://www.openwall.com/lists/oss-security/2026/05/21/7](http://www.openwall.com/lists/oss-security/2026/05/21/7)
- [http://www.openwall.com/lists/oss-security/2026/05/22/11](http://www.openwall.com/lists/oss-security/2026/05/22/11)
- [https://lists.debian.org/debian-lts-announce/2026/05/msg00041.html](https://lists.debian.org/debian-lts-announce/2026/05/msg00041.html)

## Related threats

- [Linux Mint Xreader path traversal in PDF attachment saving](https://junglewise.ai/threats/cve-2026-104983-a-vulnerability-has-been-found-in-linux-mint-xreader-up-to-4-6-9)
- [Linux Mint Xreader path traversal in EPUB file handler](https://junglewise.ai/threats/cve-2026-104982-a-flaw-has-been-found-in-linux-mint-xreader-up-to-4-6-5-this)
- [TeX Live SyncTeX Parser heap use-after-free in synctex_parser.c](https://junglewise.ai/threats/cve-2026-63729-tex-live-synctex-parser-heap-use-after-free-in-synctex-parser-c)