Vulnerability-Lookup

CVE-2026-46529 (GCVE-0-2026-46529)

Vulnerability from cvelistv5 – Published: 2026-06-10 19:46 – Updated: 2026-07-23 12:08

Title

PDF /GoToR action argv injection enables single-click RCE via --gtk-module dlopen

Summary

Atril Document Viewer is the default document reader of the MATE desktop environment for Linux. A single-click remote code execution vulnerability in versions prior to 1.26.3 and 1.28.4 allows an attacker to achieve arbitrary code execution as the user by tricking them into clicking a link inside a malicious PDF document. The PDF can be packaged as a polyglot file that is simultaneously a valid PDF and a valid ELF shared library, making the attack a single-file, single-click, configuration-independent RCE on stock atril installations. The root cause is `shell/ev-application.c:ev_spawn`, which builds a command line from attacker-controlled PDF link-destination fields without applying `g_shell_quote`. The cmdline is then handed to `g_app_info_create_from_commandline`, which shell-parses it back into argv — splitting any embedded `--gtk-module=PATH` into a separate argv element. GTK then `dlopen()`s the path during init, running any `__attribute__((constructor))` it finds. Versions 1.26.3 and 1.28.4 contain a patch for the issue. This is the same defect class as CVE-2023-51698 (CBT `--checkpoint-action` injection in `comics-document.c`, fixed in 1.6.2) but in a different code path (`shell/ev-application.c`) that the original patch did not touch.

Severity

8.4 (High)


                        
                          CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

7.8 (High)


                        
                          CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

SSVC

Exploitation: poc Automatable: no Technical Impact: total

CISA Coordinator (v2.0.3)

CWE

CWE-77 - Improper Neutralization of Special Elements used in a Command ('Command Injection')
CWE-88 - Improper Neutralization of Argument Delimiters in a Command ('Argument Injection')
CWE-829 - Inclusion of Functionality from Untrusted Control Sphere

Assigner

GitHub_M

References

20 references

URL	Tags
https://github.com/mate-desktop/atril/security/ad…	x_refsource_CONFIRM
https://github.com/mate-desktop/atril/releases/ta…	x_refsource_MISC
https://github.com/mate-desktop/atril/releases/ta…	x_refsource_MISC
http://www.openwall.com/lists/oss-security/2026/0…
http://www.openwall.com/lists/oss-security/2026/05/21/7
http://www.openwall.com/lists/oss-security/2026/0…
https://lists.debian.org/debian-lts-announce/2026…
https://lists.debian.org/debian-lts-announce/2026…
https://lists.debian.org/debian-lts-announce/2026…
https://access.redhat.com/security/cve/CVE-2026-46529	vdb-entryx_refsource_REDHAT
https://bugzilla.redhat.com/show_bug.cgi?id=2487669	issue-trackingx_refsource_REDHAT
https://security.access.redhat.com/data/csaf/v2/v…	x_sadp-csaf-vex
https://access.redhat.com/errata/RHSA-2026:41904	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:28998	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:43398	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:42692	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:39115	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:33416	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:33169	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:27819	vendor-advisoryx_refsource_REDHAT

Impacted products

12 products

Vendor	Product	Version
mate-desktop	atril	Affected: < 1.26.3 Affected: >= 1.27.0, < 1.28.4
Red Hat	Red Hat Enterprise Linux 7 Extended Lifecycle Support	Unaffected: 0:3.28.2-11.el7_9 , < * (rpm) cpe:/o:redhat:rhel_els:7
Red Hat	Red Hat Enterprise Linux 8	Unaffected: 0:3.28.4-17.el8_10 , < * (rpm) cpe:/a:redhat:enterprise_linux:8
Red Hat	Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support	Unaffected: 0:3.28.4-11.el8_4.1 , < * (rpm) cpe:/a:redhat:rhel_aus:8.4
Red Hat	Red Hat Enterprise Linux 8.4 Extended Update Support Long-Life Add-On	Unaffected: 0:3.28.4-11.el8_4.1 , < * (rpm) cpe:/a:redhat:rhel_eus_long_life:8.4
Red Hat	Red Hat Enterprise Linux 8.8 Telecommunications Update Service	Unaffected: 0:3.28.4-16.el8_8.1 , < * (rpm) cpe:/a:redhat:rhel_tus:8.8
Red Hat	Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions	Unaffected: 0:3.28.4-16.el8_8.1 , < * (rpm) cpe:/a:redhat:rhel_e4s:8.8
Red Hat	Red Hat Enterprise Linux 9	Unaffected: 0:40.5-4.el9_8.1 , < * (rpm) cpe:/a:redhat:enterprise_linux:9
Red Hat	Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions	Unaffected: 0:40.5-2.el9_2.1 , < * (rpm) cpe:/a:redhat:rhel_e4s:9.2
Red Hat	Red Hat Enterprise Linux 9.4 Update Services for SAP Solutions	Unaffected: 0:40.5-2.el9_4.1 , < * (rpm) cpe:/a:redhat:rhel_e4s:9.4
Red Hat	Red Hat Enterprise Linux 9.6 Extended Update Support	Unaffected: 0:40.5-2.el9_6.1 , < * (rpm) cpe:/a:redhat:rhel_eus:9.6
Red Hat	Red Hat Enterprise Linux 6	cpe:/o:redhat:enterprise_linux:6

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2026-06-16T22:38:17.493Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "url": "http://www.openwall.com/lists/oss-security/2026/05/19/34"
          },
          {
            "url": "http://www.openwall.com/lists/oss-security/2026/05/21/7"
          },
          {
            "url": "http://www.openwall.com/lists/oss-security/2026/05/22/11"
          },
          {
            "url": "https://lists.debian.org/debian-lts-announce/2026/05/msg00041.html"
          },
          {
            "url": "https://lists.debian.org/debian-lts-announce/2026/05/msg00042.html"
          },
          {
            "url": "https://lists.debian.org/debian-lts-announce/2026/06/msg00021.html"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-46529",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-06-12T12:30:30.338432Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-06-12T12:30:51.506Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "references": [
          {
            "tags": [
              "exploit"
            ],
            "url": "https://github.com/mate-desktop/atril/security/advisories/GHSA-vgv2-m826-8f6f"
          }
        ],
        "title": "CISA ADP Vulnrichment"
      },
      {
        "affected": [
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/o:redhat:rhel_els:7"
            ],
            "defaultStatus": "affected",
            "packageName": "evince",
            "product": "Red Hat Enterprise Linux 7 Extended Lifecycle Support",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:3.28.2-11.el7_9",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:enterprise_linux:8"
            ],
            "defaultStatus": "affected",
            "packageName": "evince",
            "product": "Red Hat Enterprise Linux 8",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:3.28.4-17.el8_10",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:rhel_aus:8.4"
            ],
            "defaultStatus": "affected",
            "packageName": "evince",
            "product": "Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:3.28.4-11.el8_4.1",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:rhel_eus_long_life:8.4"
            ],
            "defaultStatus": "affected",
            "packageName": "evince",
            "product": "Red Hat Enterprise Linux 8.4 Extended Update Support Long-Life Add-On",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:3.28.4-11.el8_4.1",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:rhel_tus:8.8"
            ],
            "defaultStatus": "affected",
            "packageName": "evince",
            "product": "Red Hat Enterprise Linux 8.8 Telecommunications Update Service",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:3.28.4-16.el8_8.1",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:rhel_e4s:8.8"
            ],
            "defaultStatus": "affected",
            "packageName": "evince",
            "product": "Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:3.28.4-16.el8_8.1",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:enterprise_linux:9"
            ],
            "defaultStatus": "affected",
            "packageName": "evince",
            "product": "Red Hat Enterprise Linux 9",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:40.5-4.el9_8.1",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:rhel_e4s:9.2"
            ],
            "defaultStatus": "affected",
            "packageName": "evince",
            "product": "Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:40.5-2.el9_2.1",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:rhel_e4s:9.4"
            ],
            "defaultStatus": "affected",
            "packageName": "evince",
            "product": "Red Hat Enterprise Linux 9.4 Update Services for SAP Solutions",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:40.5-2.el9_4.1",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:rhel_eus:9.6"
            ],
            "defaultStatus": "affected",
            "packageName": "evince",
            "product": "Red Hat Enterprise Linux 9.6 Extended Update Support",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:40.5-2.el9_6.1",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/o:redhat:enterprise_linux:6"
            ],
            "defaultStatus": "affected",
            "packageName": "evince",
            "product": "Red Hat Enterprise Linux 6",
            "vendor": "Red Hat"
          }
        ],
        "datePublic": "2026-06-10T19:46:23.639Z",
        "descriptions": [
          {
            "lang": "en",
            "value": "A flaw was found in Atril, Evince and Xreader. A malicious link inside a specially crafted PDF document can cause arbitrary code execution when clicked due to improper quoting of attacker-controlled PDF link-destination fields during remote go-to (/GoToR) actions. This issue allows an attacker to execute arbitrary code with the privileges of the user that clicked on the embedded link."
          }
        ],
        "metrics": [
          {
            "other": {
              "content": {
                "namespace": "https://access.redhat.com/security/updates/classification/",
                "value": "Important"
              },
              "type": "Red Hat severity rating"
            }
          },
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "LOCAL",
              "availabilityImpact": "HIGH",
              "baseScore": 7.8,
              "baseSeverity": "HIGH",
              "confidentialityImpact": "HIGH",
              "integrityImpact": "HIGH",
              "privilegesRequired": "NONE",
              "scope": "UNCHANGED",
              "userInteraction": "REQUIRED",
              "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
              "version": "3.1"
            },
            "format": "CVSS"
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-77",
                "description": "Improper Neutralization of Special Elements used in a Command (\u0027Command Injection\u0027)",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-07-23T12:08:06.173Z",
          "orgId": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c",
          "shortName": "redhat-SADP"
        },
        "references": [
          {
            "tags": [
              "vdb-entry",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/security/cve/CVE-2026-46529"
          },
          {
            "name": "RHBZ#2487669",
            "tags": [
              "issue-tracking",
              "x_refsource_REDHAT"
            ],
            "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2487669"
          },
          {
            "tags": [
              "x_sadp-csaf-vex"
            ],
            "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-46529.json"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:41904"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:28998"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:43398"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:42692"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:39115"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:33416"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:33169"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:27819"
          }
        ],
        "solutions": [
          {
            "lang": "en",
            "value": "RHSA-2026:41904: Red Hat Enterprise Linux Server (v. 7 ELS), Red Hat Enterprise Linux Server Optional (v. 7 ELS)"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:28998: Red Hat Enterprise Linux AppStream (v. 8), Red Hat Enterprise Linux CRB (v. 8)"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:43398: Red Hat Enterprise Linux AppStream AUS (v.8.4), Red Hat Enterprise Linux AppStream EUS EXTENSION (v.8.4)"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:42692: Red Hat Enterprise Linux AppStream E4S (v.8.8), Red Hat Enterprise Linux AppStream TUS (v.8.8)"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:39115: Red Hat Enterprise Linux AppStream E4S (v.9.2)"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:33416: Red Hat Enterprise Linux AppStream E4S (v.9.4)"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:33169: Red Hat Enterprise Linux AppStream EUS (v.9.6)"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:27819: Red Hat Enterprise Linux AppStream (v. 9)"
          }
        ],
        "timeline": [
          {
            "lang": "en",
            "time": "2026-06-10T20:01:22.149Z",
            "value": "Reported to Red Hat."
          },
          {
            "lang": "en",
            "time": "2026-06-10T19:46:23.639Z",
            "value": "Made public."
          }
        ],
        "title": "atril: evince: xreader: PDF /GoToR action argv injection enables single-click RCE via --gtk-module dlopen",
        "workarounds": [
          {
            "lang": "en",
            "value": "To mitigate this vulnerability, do not click on links inside PDF documents from untrusted or unverified sources."
          }
        ],
        "x_adpType": "supplier",
        "x_generator": {
          "engine": "sadp-cli 1.0.0"
        }
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "atril",
          "vendor": "mate-desktop",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 1.26.3"
            },
            {
              "status": "affected",
              "version": "\u003e= 1.27.0, \u003c 1.28.4"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Atril Document Viewer is the default document reader of the MATE desktop environment for Linux. A single-click remote code execution vulnerability in versions prior to 1.26.3 and 1.28.4 allows an attacker to achieve arbitrary code execution as the user by tricking them into clicking a link inside a malicious PDF document. The PDF can be packaged as a polyglot file that is simultaneously a valid PDF and a valid ELF shared library, making the attack a single-file, single-click, configuration-independent RCE on stock atril installations. The root cause is `shell/ev-application.c:ev_spawn`, which builds a command line from attacker-controlled PDF link-destination fields without applying `g_shell_quote`. The cmdline is then handed to `g_app_info_create_from_commandline`, which shell-parses it back into argv \u2014 splitting any embedded `--gtk-module=PATH` into a separate argv element. GTK then `dlopen()`s the path during init, running any `__attribute__((constructor))` it finds. Versions 1.26.3 and 1.28.4 contain a patch for the issue. This is the same defect class as CVE-2023-51698 (CBT `--checkpoint-action` injection in `comics-document.c`, fixed in 1.6.2) but in a different code path (`shell/ev-application.c`) that the original patch did not touch."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "LOCAL",
            "baseScore": 8.4,
            "baseSeverity": "HIGH",
            "privilegesRequired": "NONE",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "ACTIVE",
            "vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "HIGH",
            "vulnConfidentialityImpact": "HIGH",
            "vulnIntegrityImpact": "HIGH"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-77",
              "description": "CWE-77: Improper Neutralization of Special Elements used in a Command (\u0027Command Injection\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-88",
              "description": "CWE-88: Improper Neutralization of Argument Delimiters in a Command (\u0027Argument Injection\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-829",
              "description": "CWE-829: Inclusion of Functionality from Untrusted Control Sphere",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-06-10T19:46:23.639Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/mate-desktop/atril/security/advisories/GHSA-vgv2-m826-8f6f",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/mate-desktop/atril/security/advisories/GHSA-vgv2-m826-8f6f"
        },
        {
          "name": "https://github.com/mate-desktop/atril/releases/tag/v1.26.3",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/mate-desktop/atril/releases/tag/v1.26.3"
        },
        {
          "name": "https://github.com/mate-desktop/atril/releases/tag/v1.28.4",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/mate-desktop/atril/releases/tag/v1.28.4"
        }
      ],
      "source": {
        "advisory": "GHSA-vgv2-m826-8f6f",
        "discovery": "UNKNOWN"
      },
      "title": "PDF /GoToR action argv injection enables single-click RCE via --gtk-module dlopen"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-46529",
    "datePublished": "2026-06-10T19:46:23.639Z",
    "dateReserved": "2026-05-14T19:12:32.756Z",
    "dateUpdated": "2026-07-23T12:08:06.173Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-46529",
      "date": "2026-07-27",
      "epss": "0.00529",
      "percentile": "0.41571"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2026-46529\",\"sourceIdentifier\":\"security-advisories@github.com\",\"published\":\"2026-06-10T20:17:28.570\",\"lastModified\":\"2026-07-23T12:18:19.343\",\"vulnStatus\":\"Deferred\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"Atril Document Viewer is the default document reader of the MATE desktop environment for Linux. A single-click remote code execution vulnerability in versions prior to 1.26.3 and 1.28.4 allows an attacker to achieve arbitrary code execution as the user by tricking them into clicking a link inside a malicious PDF document. The PDF can be packaged as a polyglot file that is simultaneously a valid PDF and a valid ELF shared library, making the attack a single-file, single-click, configuration-independent RCE on stock atril installations. The root cause is `shell/ev-application.c:ev_spawn`, which builds a command line from attacker-controlled PDF link-destination fields without applying `g_shell_quote`. The cmdline is then handed to `g_app_info_create_from_commandline`, which shell-parses it back into argv \u2014 splitting any embedded `--gtk-module=PATH` into a separate argv element. GTK then `dlopen()`s the path during init, running any `__attribute__((constructor))` it finds. Versions 1.26.3 and 1.28.4 contain a patch for the issue. This is the same defect class as CVE-2023-51698 (CBT `--checkpoint-action` injection in `comics-document.c`, fixed in 1.6.2) but in a different code path (`shell/ev-application.c`) that the original patch did not touch.\"}],\"affected\":[{\"source\":\"security-advisories@github.com\",\"affectedData\":[{\"vendor\":\"mate-desktop\",\"product\":\"atril\",\"versions\":[{\"version\":\"\u003c 1.26.3\",\"status\":\"affected\"},{\"version\":\"\u003e= 1.27.0, \u003c 1.28.4\",\"status\":\"affected\"}]}]},{\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\",\"affectedData\":[{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Enterprise Linux 7 Extended Lifecycle Support\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"evince\",\"cpes\":[\"cpe:/o:redhat:rhel_els:7\"],\"versions\":[{\"version\":\"0:3.28.2-11.el7_9\",\"lessThan\":\"*\",\"versionType\":\"rpm\",\"status\":\"unaffected\"}]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Enterprise Linux 8\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"evince\",\"cpes\":[\"cpe:/a:redhat:enterprise_linux:8\"],\"versions\":[{\"version\":\"0:3.28.4-17.el8_10\",\"lessThan\":\"*\",\"versionType\":\"rpm\",\"status\":\"unaffected\"}]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"evince\",\"cpes\":[\"cpe:/a:redhat:rhel_aus:8.4\"],\"versions\":[{\"version\":\"0:3.28.4-11.el8_4.1\",\"lessThan\":\"*\",\"versionType\":\"rpm\",\"status\":\"unaffected\"}]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Enterprise Linux 8.4 Extended Update Support Long-Life Add-On\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"evince\",\"cpes\":[\"cpe:/a:redhat:rhel_eus_long_life:8.4\"],\"versions\":[{\"version\":\"0:3.28.4-11.el8_4.1\",\"lessThan\":\"*\",\"versionType\":\"rpm\",\"status\":\"unaffected\"}]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Enterprise Linux 8.8 Telecommunications Update Service\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"evince\",\"cpes\":[\"cpe:/a:redhat:rhel_tus:8.8\"],\"versions\":[{\"version\":\"0:3.28.4-16.el8_8.1\",\"lessThan\":\"*\",\"versionType\":\"rpm\",\"status\":\"unaffected\"}]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"evince\",\"cpes\":[\"cpe:/a:redhat:rhel_e4s:8.8\"],\"versions\":[{\"version\":\"0:3.28.4-16.el8_8.1\",\"lessThan\":\"*\",\"versionType\":\"rpm\",\"status\":\"unaffected\"}]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Enterprise Linux 9\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"evince\",\"cpes\":[\"cpe:/a:redhat:enterprise_linux:9\"],\"versions\":[{\"version\":\"0:40.5-4.el9_8.1\",\"lessThan\":\"*\",\"versionType\":\"rpm\",\"status\":\"unaffected\"}]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"evince\",\"cpes\":[\"cpe:/a:redhat:rhel_e4s:9.2\"],\"versions\":[{\"version\":\"0:40.5-2.el9_2.1\",\"lessThan\":\"*\",\"versionType\":\"rpm\",\"status\":\"unaffected\"}]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Enterprise Linux 9.4 Update Services for SAP Solutions\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"evince\",\"cpes\":[\"cpe:/a:redhat:rhel_e4s:9.4\"],\"versions\":[{\"version\":\"0:40.5-2.el9_4.1\",\"lessThan\":\"*\",\"versionType\":\"rpm\",\"status\":\"unaffected\"}]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Enterprise Linux 9.6 Extended Update Support\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"evince\",\"cpes\":[\"cpe:/a:redhat:rhel_eus:9.6\"],\"versions\":[{\"version\":\"0:40.5-2.el9_6.1\",\"lessThan\":\"*\",\"versionType\":\"rpm\",\"status\":\"unaffected\"}]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Enterprise Linux 6\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"evince\",\"cpes\":[\"cpe:/o:redhat:enterprise_linux:6\"]}]}],\"metrics\":{\"cvssMetricV40\":[{\"source\":\"security-advisories@github.com\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"4.0\",\"vectorString\":\"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X\",\"baseScore\":8.4,\"baseSeverity\":\"HIGH\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"attackRequirements\":\"NONE\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"ACTIVE\",\"vulnConfidentialityImpact\":\"HIGH\",\"vulnIntegrityImpact\":\"HIGH\",\"vulnAvailabilityImpact\":\"HIGH\",\"subConfidentialityImpact\":\"NONE\",\"subIntegrityImpact\":\"NONE\",\"subAvailabilityImpact\":\"NONE\",\"exploitMaturity\":\"NOT_DEFINED\",\"confidentialityRequirement\":\"NOT_DEFINED\",\"integrityRequirement\":\"NOT_DEFINED\",\"availabilityRequirement\":\"NOT_DEFINED\",\"modifiedAttackVector\":\"NOT_DEFINED\",\"modifiedAttackComplexity\":\"NOT_DEFINED\",\"modifiedAttackRequirements\":\"NOT_DEFINED\",\"modifiedPrivilegesRequired\":\"NOT_DEFINED\",\"modifiedUserInteraction\":\"NOT_DEFINED\",\"modifiedVulnConfidentialityImpact\":\"NOT_DEFINED\",\"modifiedVulnIntegrityImpact\":\"NOT_DEFINED\",\"modifiedVulnAvailabilityImpact\":\"NOT_DEFINED\",\"modifiedSubConfidentialityImpact\":\"NOT_DEFINED\",\"modifiedSubIntegrityImpact\":\"NOT_DEFINED\",\"modifiedSubAvailabilityImpact\":\"NOT_DEFINED\",\"Safety\":\"NOT_DEFINED\",\"Automatable\":\"NOT_DEFINED\",\"Recovery\":\"NOT_DEFINED\",\"valueDensity\":\"NOT_DEFINED\",\"vulnerabilityResponseEffort\":\"NOT_DEFINED\",\"providerUrgency\":\"NOT_DEFINED\"}}],\"cvssMetricV31\":[{\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H\",\"baseScore\":7.8,\"baseSeverity\":\"HIGH\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"REQUIRED\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":5.9}],\"ssvcV203\":[{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"ssvcData\":{\"timestamp\":\"2026-06-12T12:30:30.338432Z\",\"id\":\"CVE-2026-46529\",\"options\":[{\"exploitation\":\"poc\"},{\"automatable\":\"no\"},{\"technicalImpact\":\"total\"}],\"role\":\"CISA Coordinator\",\"version\":\"2.0.3\"}}]},\"weaknesses\":[{\"source\":\"security-advisories@github.com\",\"type\":\"Secondary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-77\"},{\"lang\":\"en\",\"value\":\"CWE-88\"},{\"lang\":\"en\",\"value\":\"CWE-829\"}]},{\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\",\"type\":\"Secondary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-77\"}]}],\"references\":[{\"url\":\"https://github.com/mate-desktop/atril/releases/tag/v1.26.3\",\"source\":\"security-advisories@github.com\"},{\"url\":\"https://github.com/mate-desktop/atril/releases/tag/v1.28.4\",\"source\":\"security-advisories@github.com\"},{\"url\":\"https://github.com/mate-desktop/atril/security/advisories/GHSA-vgv2-m826-8f6f\",\"source\":\"security-advisories@github.com\"},{\"url\":\"http://www.openwall.com/lists/oss-security/2026/05/19/34\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"http://www.openwall.com/lists/oss-security/2026/05/21/7\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"http://www.openwall.com/lists/oss-security/2026/05/22/11\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"https://lists.debian.org/debian-lts-announce/2026/05/msg00041.html\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"https://lists.debian.org/debian-lts-announce/2026/05/msg00042.html\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"https://lists.debian.org/debian-lts-announce/2026/06/msg00021.html\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:27819\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:28998\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:33169\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:33416\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:39115\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:41904\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:42692\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:43398\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://access.redhat.com/security/cve/CVE-2026-46529\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://bugzilla.redhat.com/show_bug.cgi?id=2487669\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://github.com/mate-desktop/atril/security/advisories/GHSA-vgv2-m826-8f6f\",\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\"},{\"url\":\"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-46529.json\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"}]}}",
    "redhat_vex": {
      "aggregate_severity": "Important",
      "current_release_date": "2026-07-22T14:41:18+00:00",
      "cve": "CVE-2026-46529",
      "id": "CVE-2026-46529",
      "initial_release_date": "2026-06-10T19:46:23.639000+00:00",
      "product_status:fixed": "419",
      "product_status:known_affected": "5",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "atril: evince: xreader: PDF /GoToR action argv injection enables single-click RCE via --gtk-module dlopen",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-46529.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "important",
      "current_release_date": "2026-07-21T13:08:32Z",
      "cve": "CVE-2026-46529",
      "id": "CVE-2026-46529",
      "initial_release_date": "2026-05-21T02:28:36Z",
      "product_status:known_affected": "129",
      "product_status:recommended": "348",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2026-46529",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2026-46529.json",
      "version": "9"
    },
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CVE Program Container\", \"references\": [{\"url\": \"http://www.openwall.com/lists/oss-security/2026/05/19/34\"}, {\"url\": \"http://www.openwall.com/lists/oss-security/2026/05/21/7\"}, {\"url\": \"http://www.openwall.com/lists/oss-security/2026/05/22/11\"}, {\"url\": \"https://lists.debian.org/debian-lts-announce/2026/05/msg00041.html\"}, {\"url\": \"https://lists.debian.org/debian-lts-announce/2026/05/msg00042.html\"}, {\"url\": \"https://lists.debian.org/debian-lts-announce/2026/06/msg00021.html\"}], \"providerMetadata\": {\"orgId\": \"af854a3a-2127-422b-91ae-364da2661108\", \"shortName\": \"CVE\", \"dateUpdated\": \"2026-06-16T22:38:17.493Z\"}}, {\"title\": \"atril: evince: xreader: PDF /GoToR action argv injection enables single-click RCE via --gtk-module dlopen\", \"metrics\": [{\"other\": {\"type\": \"Red Hat severity rating\", \"content\": {\"value\": \"Important\", \"namespace\": \"https://access.redhat.com/security/updates/classification/\"}}}, {\"format\": \"CVSS\", \"cvssV3_1\": {\"scope\": \"UNCHANGED\", \"version\": \"3.1\", \"baseScore\": 7.8, \"attackVector\": \"LOCAL\", \"baseSeverity\": \"HIGH\", \"vectorString\": \"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H\", \"integrityImpact\": \"HIGH\", \"userInteraction\": \"REQUIRED\", \"attackComplexity\": \"LOW\", \"availabilityImpact\": \"HIGH\", \"privilegesRequired\": \"NONE\", \"confidentialityImpact\": \"HIGH\"}}], \"affected\": [{\"cpes\": [\"cpe:/o:redhat:rhel_els:7\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Enterprise Linux 7 Extended Lifecycle Support\", \"versions\": [{\"status\": \"unaffected\", \"version\": \"0:3.28.2-11.el7_9\", \"lessThan\": \"*\", \"versionType\": \"rpm\"}], \"packageName\": \"evince\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:enterprise_linux:8\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Enterprise Linux 8\", \"versions\": [{\"status\": \"unaffected\", \"version\": \"0:3.28.4-17.el8_10\", \"lessThan\": \"*\", \"versionType\": \"rpm\"}], \"packageName\": \"evince\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:rhel_tus:8.8\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Enterprise Linux 8.8 Telecommunications Update Service\", \"versions\": [{\"status\": \"unaffected\", \"version\": \"0:3.28.4-16.el8_8.1\", \"lessThan\": \"*\", \"versionType\": \"rpm\"}], \"packageName\": \"evince\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:rhel_e4s:8.8\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions\", \"versions\": [{\"status\": \"unaffected\", \"version\": \"0:3.28.4-16.el8_8.1\", \"lessThan\": \"*\", \"versionType\": \"rpm\"}], \"packageName\": \"evince\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:enterprise_linux:9\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Enterprise Linux 9\", \"versions\": [{\"status\": \"unaffected\", \"version\": \"0:40.5-4.el9_8.1\", \"lessThan\": \"*\", \"versionType\": \"rpm\"}], \"packageName\": \"evince\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:rhel_e4s:9.2\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions\", \"versions\": [{\"status\": \"unaffected\", \"version\": \"0:40.5-2.el9_2.1\", \"lessThan\": \"*\", \"versionType\": \"rpm\"}], \"packageName\": \"evince\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:rhel_e4s:9.4\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Enterprise Linux 9.4 Update Services for SAP Solutions\", \"versions\": [{\"status\": \"unaffected\", \"version\": \"0:40.5-2.el9_4.1\", \"lessThan\": \"*\", \"versionType\": \"rpm\"}], \"packageName\": \"evince\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:rhel_eus:9.6\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Enterprise Linux 9.6 Extended Update Support\", \"versions\": [{\"status\": \"unaffected\", \"version\": \"0:40.5-2.el9_6.1\", \"lessThan\": \"*\", \"versionType\": \"rpm\"}], \"packageName\": \"evince\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/o:redhat:enterprise_linux:6\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Enterprise Linux 6\", \"packageName\": \"evince\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"affected\"}], \"timeline\": [{\"lang\": \"en\", \"time\": \"2026-06-10T20:01:22.149Z\", \"value\": \"Reported to Red Hat.\"}, {\"lang\": \"en\", \"time\": \"2026-06-10T19:46:23.639Z\", \"value\": \"Made public.\"}], \"solutions\": [{\"lang\": \"en\", \"value\": \"RHSA-2026:41904: Red Hat Enterprise Linux Server (v. 7 ELS), Red Hat Enterprise Linux Server Optional (v. 7 ELS)\"}, {\"lang\": \"en\", \"value\": \"RHSA-2026:28998: Red Hat Enterprise Linux AppStream (v. 8), Red Hat Enterprise Linux CRB (v. 8)\"}, {\"lang\": \"en\", \"value\": \"RHSA-2026:42692: Red Hat Enterprise Linux AppStream E4S (v.8.8), Red Hat Enterprise Linux AppStream TUS (v.8.8)\"}, {\"lang\": \"en\", \"value\": \"RHSA-2026:39115: Red Hat Enterprise Linux AppStream E4S (v.9.2)\"}, {\"lang\": \"en\", \"value\": \"RHSA-2026:33416: Red Hat Enterprise Linux AppStream E4S (v.9.4)\"}, {\"lang\": \"en\", \"value\": \"RHSA-2026:33169: Red Hat Enterprise Linux AppStream EUS (v.9.6)\"}, {\"lang\": \"en\", \"value\": \"RHSA-2026:27819: Red Hat Enterprise Linux AppStream (v. 9)\"}], \"x_adpType\": \"supplier\", \"datePublic\": \"2026-06-10T19:46:23.639Z\", \"references\": [{\"url\": \"https://access.redhat.com/security/cve/CVE-2026-46529\", \"tags\": [\"vdb-entry\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://bugzilla.redhat.com/show_bug.cgi?id=2487669\", \"name\": \"RHBZ#2487669\", \"tags\": [\"issue-tracking\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-46529.json\", \"tags\": [\"x_sadp-csaf-vex\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2026:41904\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2026:28998\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2026:42692\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2026:39115\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2026:33416\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2026:33169\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2026:27819\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}], \"workarounds\": [{\"lang\": \"en\", \"value\": \"To mitigate this vulnerability, do not click on links inside PDF documents from untrusted or unverified sources.\"}], \"x_generator\": {\"engine\": \"sadp-cli 1.0.0\"}, \"descriptions\": [{\"lang\": \"en\", \"value\": \"A flaw was found in Atril, Evince and Xreader. A malicious link inside a specially crafted PDF document can cause arbitrary code execution when clicked due to improper quoting of attacker-controlled PDF link-destination fields during remote go-to (/GoToR) actions. This issue allows an attacker to execute arbitrary code with the privileges of the user that clicked on the embedded link.\"}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-77\", \"description\": \"Improper Neutralization of Special Elements used in a Command (\u0027Command Injection\u0027)\"}]}], \"providerMetadata\": {\"orgId\": \"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\", \"shortName\": \"redhat-SADP\", \"dateUpdated\": \"2026-07-22T12:08:38.380Z\"}}, {\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2026-46529\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"poc\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"total\"}], \"version\": \"2.0.3\", \"timestamp\": \"2026-06-12T12:30:30.338432Z\"}}}], \"references\": [{\"url\": \"https://github.com/mate-desktop/atril/security/advisories/GHSA-vgv2-m826-8f6f\", \"tags\": [\"exploit\"]}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2026-06-12T12:30:47.928Z\"}}], \"cna\": {\"title\": \"PDF /GoToR action argv injection enables single-click RCE via --gtk-module dlopen\", \"source\": {\"advisory\": \"GHSA-vgv2-m826-8f6f\", \"discovery\": \"UNKNOWN\"}, \"metrics\": [{\"cvssV4_0\": {\"version\": \"4.0\", \"baseScore\": 8.4, \"attackVector\": \"LOCAL\", \"baseSeverity\": \"HIGH\", \"vectorString\": \"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N\", \"userInteraction\": \"ACTIVE\", \"attackComplexity\": \"LOW\", \"attackRequirements\": \"NONE\", \"privilegesRequired\": \"NONE\", \"subIntegrityImpact\": \"NONE\", \"vulnIntegrityImpact\": \"HIGH\", \"subAvailabilityImpact\": \"NONE\", \"vulnAvailabilityImpact\": \"HIGH\", \"subConfidentialityImpact\": \"NONE\", \"vulnConfidentialityImpact\": \"HIGH\"}}], \"affected\": [{\"vendor\": \"mate-desktop\", \"product\": \"atril\", \"versions\": [{\"status\": \"affected\", \"version\": \"\u003c 1.26.3\"}, {\"status\": \"affected\", \"version\": \"\u003e= 1.27.0, \u003c 1.28.4\"}]}], \"references\": [{\"url\": \"https://github.com/mate-desktop/atril/security/advisories/GHSA-vgv2-m826-8f6f\", \"name\": \"https://github.com/mate-desktop/atril/security/advisories/GHSA-vgv2-m826-8f6f\", \"tags\": [\"x_refsource_CONFIRM\"]}, {\"url\": \"https://github.com/mate-desktop/atril/releases/tag/v1.26.3\", \"name\": \"https://github.com/mate-desktop/atril/releases/tag/v1.26.3\", \"tags\": [\"x_refsource_MISC\"]}, {\"url\": \"https://github.com/mate-desktop/atril/releases/tag/v1.28.4\", \"name\": \"https://github.com/mate-desktop/atril/releases/tag/v1.28.4\", \"tags\": [\"x_refsource_MISC\"]}], \"descriptions\": [{\"lang\": \"en\", \"value\": \"Atril Document Viewer is the default document reader of the MATE desktop environment for Linux. A single-click remote code execution vulnerability in versions prior to 1.26.3 and 1.28.4 allows an attacker to achieve arbitrary code execution as the user by tricking them into clicking a link inside a malicious PDF document. The PDF can be packaged as a polyglot file that is simultaneously a valid PDF and a valid ELF shared library, making the attack a single-file, single-click, configuration-independent RCE on stock atril installations. The root cause is `shell/ev-application.c:ev_spawn`, which builds a command line from attacker-controlled PDF link-destination fields without applying `g_shell_quote`. The cmdline is then handed to `g_app_info_create_from_commandline`, which shell-parses it back into argv \\u2014 splitting any embedded `--gtk-module=PATH` into a separate argv element. GTK then `dlopen()`s the path during init, running any `__attribute__((constructor))` it finds. Versions 1.26.3 and 1.28.4 contain a patch for the issue. This is the same defect class as CVE-2023-51698 (CBT `--checkpoint-action` injection in `comics-document.c`, fixed in 1.6.2) but in a different code path (`shell/ev-application.c`) that the original patch did not touch.\"}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-77\", \"description\": \"CWE-77: Improper Neutralization of Special Elements used in a Command (\u0027Command Injection\u0027)\"}]}, {\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-88\", \"description\": \"CWE-88: Improper Neutralization of Argument Delimiters in a Command (\u0027Argument Injection\u0027)\"}]}, {\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-829\", \"description\": \"CWE-829: Inclusion of Functionality from Untrusted Control Sphere\"}]}], \"providerMetadata\": {\"orgId\": \"a0819718-46f1-4df5-94e2-005712e83aaa\", \"shortName\": \"GitHub_M\", \"dateUpdated\": \"2026-06-10T19:46:23.639Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2026-46529\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2026-07-22T12:08:38.380Z\", \"dateReserved\": \"2026-05-14T19:12:32.756Z\", \"assignerOrgId\": \"a0819718-46f1-4df5-94e2-005712e83aaa\", \"datePublished\": \"2026-06-10T19:46:23.639Z\", \"assignerShortName\": \"GitHub_M\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}

ubuntu-cve-2026-46529

Vulnerability from osv_ubuntu

Published

2026-05-20 00:00

Modified

2026-06-30 16:22

Summary

Details

Atril Document Viewer is the default document reader of the MATE desktop environment for Linux. A single-click remote code execution vulnerability in versions prior to 1.26.3 and 1.28.4 allows an attacker to achieve arbitrary code execution as the user by tricking them into clicking a link inside a malicious PDF document. The PDF can be packaged as a polyglot file that is simultaneously a valid PDF and a valid ELF shared library, making the attack a single-file, single-click, configuration-independent RCE on stock atril installations. The root cause is shell/ev-application.c:ev_spawn, which builds a command line from attacker-controlled PDF link-destination fields without applying g_shell_quote. The cmdline is then handed to g_app_info_create_from_commandline, which shell-parses it back into argv — splitting any embedded --gtk-module=PATH into a separate argv element. GTK then dlopen()s the path during init, running any __attribute__((constructor)) it finds. Versions 1.26.3 and 1.28.4 contain a patch for the issue. This is the same defect class as CVE-2023-51698 (CBT --checkpoint-action injection in comics-document.c, fixed in 1.6.2) but in a different code path (shell/ev-application.c) that the original patch did not touch.

Severity

8.4 (High)


                    
                      CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

7.8 (High)


                    
                      CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

N/A (UNKNOWN)


                    
                      medium

References

URL

Type

	https://ubuntu.com/security/CVE-2026-46529	REPORT
	https://www.cve.org/CVERecord?id=CVE-2026-46529	REPORT
	https://www.openwall.com/lists/oss-security/2026/…	REPORT
	https://medeiros.zip/posts/CVE-2026-46529-evince	REPORT
	https://blogs.gnome.org/mcatanzaro/2026/05/21/sin…	REPORT
	https://ubuntu.com/security/notices/USN-8295-1	ADVISORY
	https://ubuntu.com/security/notices/USN-8321-1	ADVISORY

JSON

To clipboard

{
  "affected": [
    {
      "ecosystem_specific": {
        "binaries": [
          {
            "binary_name": "evince",
            "binary_version": "3.18.2-1ubuntu4.6"
          },
          {
            "binary_name": "evince-common",
            "binary_version": "3.18.2-1ubuntu4.6"
          },
          {
            "binary_name": "evince-gtk",
            "binary_version": "3.18.2-1ubuntu4.6"
          },
          {
            "binary_name": "gir1.2-evince-3.0",
            "binary_version": "3.18.2-1ubuntu4.6"
          },
          {
            "binary_name": "libevdocument3-4",
            "binary_version": "3.18.2-1ubuntu4.6"
          },
          {
            "binary_name": "libevview3-3",
            "binary_version": "3.18.2-1ubuntu4.6"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:16.04:LTS",
        "name": "evince",
        "purl": "pkg:deb/ubuntu/evince@3.18.2-1ubuntu4.6?arch=source\u0026distro=xenial"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "3.16.1-0ubuntu1",
        "3.18.1-1ubuntu1",
        "3.18.1-1ubuntu2",
        "3.18.2-1ubuntu1",
        "3.18.2-1ubuntu2",
        "3.18.2-1ubuntu3",
        "3.18.2-1ubuntu4",
        "3.18.2-1ubuntu4.1",
        "3.18.2-1ubuntu4.2",
        "3.18.2-1ubuntu4.3",
        "3.18.2-1ubuntu4.4",
        "3.18.2-1ubuntu4.5",
        "3.18.2-1ubuntu4.6"
      ]
    },
    {
      "ecosystem_specific": {
        "binaries": [
          {
            "binary_name": "atril",
            "binary_version": "1.12.2-1ubuntu0.3+esm1"
          },
          {
            "binary_name": "atril-common",
            "binary_version": "1.12.2-1ubuntu0.3+esm1"
          },
          {
            "binary_name": "gir1.2-atril",
            "binary_version": "1.12.2-1ubuntu0.3+esm1"
          },
          {
            "binary_name": "libatrildocument3",
            "binary_version": "1.12.2-1ubuntu0.3+esm1"
          },
          {
            "binary_name": "libatrilview3",
            "binary_version": "1.12.2-1ubuntu0.3+esm1"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:Pro:16.04:LTS",
        "name": "atril",
        "purl": "pkg:deb/ubuntu/atril@1.12.2-1ubuntu0.3+esm1?arch=source\u0026distro=esm-apps/xenial"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "1.10.2+repack1-1",
        "1.12.2-1",
        "1.12.2-1ubuntu0.1",
        "1.12.2-1ubuntu0.2",
        "1.12.2-1ubuntu0.3",
        "1.12.2-1ubuntu0.3+esm1"
      ]
    },
    {
      "ecosystem_specific": {
        "binaries": [
          {
            "binary_name": "browser-plugin-evince",
            "binary_version": "3.28.4-0ubuntu1.2"
          },
          {
            "binary_name": "evince",
            "binary_version": "3.28.4-0ubuntu1.2"
          },
          {
            "binary_name": "evince-common",
            "binary_version": "3.28.4-0ubuntu1.2"
          },
          {
            "binary_name": "gir1.2-evince-3.0",
            "binary_version": "3.28.4-0ubuntu1.2"
          },
          {
            "binary_name": "libevdocument3-4",
            "binary_version": "3.28.4-0ubuntu1.2"
          },
          {
            "binary_name": "libevview3-3",
            "binary_version": "3.28.4-0ubuntu1.2"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:18.04:LTS",
        "name": "evince",
        "purl": "pkg:deb/ubuntu/evince@3.28.4-0ubuntu1.2?arch=source\u0026distro=bionic"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "3.26.0-1",
        "3.26.0-2",
        "3.26.0-3",
        "3.27.91-1",
        "3.27.92-1",
        "3.28.0-1",
        "3.28.2-1",
        "3.28.4-0ubuntu1",
        "3.28.4-0ubuntu1.1",
        "3.28.4-0ubuntu1.2"
      ]
    },
    {
      "ecosystem_specific": {
        "binaries": [
          {
            "binary_name": "atril",
            "binary_version": "1.20.1-2ubuntu2+esm2"
          },
          {
            "binary_name": "atril-common",
            "binary_version": "1.20.1-2ubuntu2+esm2"
          },
          {
            "binary_name": "gir1.2-atril",
            "binary_version": "1.20.1-2ubuntu2+esm2"
          },
          {
            "binary_name": "gir1.2-atrildocument-1.5.0",
            "binary_version": "1.20.1-2ubuntu2+esm2"
          },
          {
            "binary_name": "gir1.2-atrilview-1.5.0",
            "binary_version": "1.20.1-2ubuntu2+esm2"
          },
          {
            "binary_name": "libatrildocument3",
            "binary_version": "1.20.1-2ubuntu2+esm2"
          },
          {
            "binary_name": "libatrilview3",
            "binary_version": "1.20.1-2ubuntu2+esm2"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:Pro:18.04:LTS",
        "name": "atril",
        "purl": "pkg:deb/ubuntu/atril@1.20.1-2ubuntu2+esm2?arch=source\u0026distro=esm-apps/bionic"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "1.18.1-1",
        "1.18.3-1",
        "1.19.6-0ubuntu1",
        "1.20.0-0ubuntu1",
        "1.20.1-0ubuntu1",
        "1.20.1-1",
        "1.20.1-2ubuntu1",
        "1.20.1-2ubuntu2",
        "1.20.1-2ubuntu2+esm1",
        "1.20.1-2ubuntu2+esm2"
      ]
    },
    {
      "ecosystem_specific": {
        "binaries": [
          {
            "binary_name": "evince",
            "binary_version": "3.36.10-0ubuntu1"
          },
          {
            "binary_name": "evince-common",
            "binary_version": "3.36.10-0ubuntu1"
          },
          {
            "binary_name": "gir1.2-evince-3.0",
            "binary_version": "3.36.10-0ubuntu1"
          },
          {
            "binary_name": "libevdocument3-4",
            "binary_version": "3.36.10-0ubuntu1"
          },
          {
            "binary_name": "libevview3-3",
            "binary_version": "3.36.10-0ubuntu1"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:20.04:LTS",
        "name": "evince",
        "purl": "pkg:deb/ubuntu/evince@3.36.10-0ubuntu1?arch=source\u0026distro=focal"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "3.34.1-1",
        "3.34.1-1build1",
        "3.35.1-1",
        "3.35.1-1build1",
        "3.35.92-1",
        "3.36.0-1",
        "3.36.0-2",
        "3.36.5-0ubuntu1",
        "3.36.7-0ubuntu1",
        "3.36.10-0ubuntu1"
      ]
    },
    {
      "ecosystem_specific": {
        "binaries": [
          {
            "binary_name": "atril",
            "binary_version": "1.24.0-1ubuntu0.2"
          },
          {
            "binary_name": "atril-common",
            "binary_version": "1.24.0-1ubuntu0.2"
          },
          {
            "binary_name": "gir1.2-atril",
            "binary_version": "1.24.0-1ubuntu0.2"
          },
          {
            "binary_name": "gir1.2-atrildocument-1.5.0",
            "binary_version": "1.24.0-1ubuntu0.2"
          },
          {
            "binary_name": "gir1.2-atrilview-1.5.0",
            "binary_version": "1.24.0-1ubuntu0.2"
          },
          {
            "binary_name": "libatrildocument3",
            "binary_version": "1.24.0-1ubuntu0.2"
          },
          {
            "binary_name": "libatrilview3",
            "binary_version": "1.24.0-1ubuntu0.2"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:20.04:LTS",
        "name": "atril",
        "purl": "pkg:deb/ubuntu/atril@1.24.0-1ubuntu0.2?arch=source\u0026distro=focal"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "1.22.2-0ubuntu1",
        "1.24.0-0ubuntu1",
        "1.24.0-1",
        "1.24.0-1ubuntu0.1",
        "1.24.0-1ubuntu0.2"
      ]
    },
    {
      "ecosystem_specific": {
        "binaries": [
          {
            "binary_name": "atril",
            "binary_version": "1.26.0-1ubuntu1.2"
          },
          {
            "binary_name": "atril-common",
            "binary_version": "1.26.0-1ubuntu1.2"
          },
          {
            "binary_name": "gir1.2-atrildocument-1.5.0",
            "binary_version": "1.26.0-1ubuntu1.2"
          },
          {
            "binary_name": "gir1.2-atrilview-1.5.0",
            "binary_version": "1.26.0-1ubuntu1.2"
          },
          {
            "binary_name": "libatrildocument3",
            "binary_version": "1.26.0-1ubuntu1.2"
          },
          {
            "binary_name": "libatrilview3",
            "binary_version": "1.26.0-1ubuntu1.2"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:22.04:LTS",
        "name": "atril",
        "purl": "pkg:deb/ubuntu/atril@1.26.0-1ubuntu1.2?arch=source\u0026distro=jammy"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "1.26.0-0ubuntu1",
        "1.26.0-1ubuntu1",
        "1.26.0-1ubuntu1.1",
        "1.26.0-1ubuntu1.2"
      ]
    },
    {
      "ecosystem_specific": {
        "availability": "No subscription required",
        "binaries": [
          {
            "binary_name": "evince",
            "binary_version": "42.3-0ubuntu3.2"
          },
          {
            "binary_name": "evince-common",
            "binary_version": "42.3-0ubuntu3.2"
          },
          {
            "binary_name": "gir1.2-evince-3.0",
            "binary_version": "42.3-0ubuntu3.2"
          },
          {
            "binary_name": "libevdocument3-4",
            "binary_version": "42.3-0ubuntu3.2"
          },
          {
            "binary_name": "libevview3-3",
            "binary_version": "42.3-0ubuntu3.2"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:22.04:LTS",
        "name": "evince",
        "purl": "pkg:deb/ubuntu/evince@42.3-0ubuntu3.2?arch=source\u0026distro=jammy"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "42.3-0ubuntu3.2"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "40.4-2",
        "41.2-1",
        "41.3-1",
        "41.3-2",
        "41.3-3",
        "42~rc-1",
        "42.0-1",
        "42.1-1",
        "42.1-2",
        "42.1-3",
        "42.3-0ubuntu1",
        "42.3-0ubuntu2",
        "42.3-0ubuntu3",
        "42.3-0ubuntu3.1"
      ]
    },
    {
      "ecosystem_specific": {
        "binaries": [
          {
            "binary_name": "atril",
            "binary_version": "1.26.2-3build2"
          },
          {
            "binary_name": "atril-common",
            "binary_version": "1.26.2-3build2"
          },
          {
            "binary_name": "gir1.2-atrildocument-1.5.0",
            "binary_version": "1.26.2-3build2"
          },
          {
            "binary_name": "gir1.2-atrilview-1.5.0",
            "binary_version": "1.26.2-3build2"
          },
          {
            "binary_name": "libatrildocument3t64",
            "binary_version": "1.26.2-3build2"
          },
          {
            "binary_name": "libatrilview3t64",
            "binary_version": "1.26.2-3build2"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:24.04:LTS",
        "name": "atril",
        "purl": "pkg:deb/ubuntu/atril@1.26.2-3build2?arch=source\u0026distro=noble"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "1.26.0-2fakesync1",
        "1.26.1-1",
        "1.26.1-3",
        "1.26.1-4",
        "1.26.2-1",
        "1.26.2-1.1build3",
        "1.26.2-3build1",
        "1.26.2-3build2"
      ]
    },
    {
      "ecosystem_specific": {
        "availability": "No subscription required",
        "binaries": [
          {
            "binary_name": "evince",
            "binary_version": "46.3.1-0ubuntu1.1"
          },
          {
            "binary_name": "evince-common",
            "binary_version": "46.3.1-0ubuntu1.1"
          },
          {
            "binary_name": "gir1.2-evince-3.0",
            "binary_version": "46.3.1-0ubuntu1.1"
          },
          {
            "binary_name": "libevdocument3-4t64",
            "binary_version": "46.3.1-0ubuntu1.1"
          },
          {
            "binary_name": "libevview3-3t64",
            "binary_version": "46.3.1-0ubuntu1.1"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:24.04:LTS",
        "name": "evince",
        "purl": "pkg:deb/ubuntu/evince@46.3.1-0ubuntu1.1?arch=source\u0026distro=noble"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "46.3.1-0ubuntu1.1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "45.0-1",
        "46.0-1",
        "46.0-1build1",
        "46.3.1-0ubuntu1"
      ]
    },
    {
      "ecosystem_specific": {
        "binaries": [
          {
            "binary_name": "atril",
            "binary_version": "1.26.2-5"
          },
          {
            "binary_name": "atril-common",
            "binary_version": "1.26.2-5"
          },
          {
            "binary_name": "gir1.2-atrildocument-1.5.0",
            "binary_version": "1.26.2-5"
          },
          {
            "binary_name": "gir1.2-atrilview-1.5.0",
            "binary_version": "1.26.2-5"
          },
          {
            "binary_name": "libatrildocument3t64",
            "binary_version": "1.26.2-5"
          },
          {
            "binary_name": "libatrilview3t64",
            "binary_version": "1.26.2-5"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:25.10",
        "name": "atril",
        "purl": "pkg:deb/ubuntu/atril@1.26.2-5?arch=source\u0026distro=questing"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "1.26.2-4",
        "1.26.2-4build1",
        "1.26.2-5"
      ]
    },
    {
      "ecosystem_specific": {
        "availability": "No subscription required",
        "binaries": [
          {
            "binary_name": "evince",
            "binary_version": "48.1-3ubuntu2.1"
          },
          {
            "binary_name": "evince-common",
            "binary_version": "48.1-3ubuntu2.1"
          },
          {
            "binary_name": "gir1.2-evince-3.0",
            "binary_version": "48.1-3ubuntu2.1"
          },
          {
            "binary_name": "libevdocument3-4t64",
            "binary_version": "48.1-3ubuntu2.1"
          },
          {
            "binary_name": "libevview3-3t64",
            "binary_version": "48.1-3ubuntu2.1"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:25.10",
        "name": "evince",
        "purl": "pkg:deb/ubuntu/evince@48.1-3ubuntu2.1?arch=source\u0026distro=questing"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "48.1-3ubuntu2.1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "48.0-1ubuntu1",
        "48.0-1ubuntu2",
        "48.1-3ubuntu2"
      ]
    },
    {
      "ecosystem_specific": {
        "availability": "No subscription required",
        "binaries": [
          {
            "binary_name": "gir1.2-papers-4.0",
            "binary_version": "48.0-1ubuntu1.25.10.4"
          },
          {
            "binary_name": "libppsdocument-4.0-5",
            "binary_version": "48.0-1ubuntu1.25.10.4"
          },
          {
            "binary_name": "libppsview-4.0-4",
            "binary_version": "48.0-1ubuntu1.25.10.4"
          },
          {
            "binary_name": "papers",
            "binary_version": "48.0-1ubuntu1.25.10.4"
          },
          {
            "binary_name": "papers-common",
            "binary_version": "48.0-1ubuntu1.25.10.4"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:25.10",
        "name": "papers",
        "purl": "pkg:deb/ubuntu/papers@48.0-1ubuntu1.25.10.4?arch=source\u0026distro=questing"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "48.0-1ubuntu1.25.10.4"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "48.0-1ubuntu1",
        "48.0-1ubuntu1.25.10.1",
        "48.0-1ubuntu1.25.10.2",
        "48.0-1ubuntu1.25.10.3"
      ]
    },
    {
      "ecosystem_specific": {
        "binaries": [
          {
            "binary_name": "atril",
            "binary_version": "1.28.2-1"
          },
          {
            "binary_name": "atril-common",
            "binary_version": "1.28.2-1"
          },
          {
            "binary_name": "gir1.2-atrildocument-1.5.0",
            "binary_version": "1.28.2-1"
          },
          {
            "binary_name": "gir1.2-atrilview-1.5.0",
            "binary_version": "1.28.2-1"
          },
          {
            "binary_name": "libatrildocument3t64",
            "binary_version": "1.28.2-1"
          },
          {
            "binary_name": "libatrilview3t64",
            "binary_version": "1.28.2-1"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:26.04:LTS",
        "name": "atril",
        "purl": "pkg:deb/ubuntu/atril@1.28.2-1?arch=source\u0026distro=resolute"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "1.26.2-5",
        "1.28.2-1"
      ]
    },
    {
      "ecosystem_specific": {
        "availability": "No subscription required",
        "binaries": [
          {
            "binary_name": "evince",
            "binary_version": "49~alpha-2ubuntu2.1"
          },
          {
            "binary_name": "evince-common",
            "binary_version": "49~alpha-2ubuntu2.1"
          },
          {
            "binary_name": "gir1.2-evince-4.0",
            "binary_version": "49~alpha-2ubuntu2.1"
          },
          {
            "binary_name": "libevdocument-4.0-6",
            "binary_version": "49~alpha-2ubuntu2.1"
          },
          {
            "binary_name": "libevview-4.0-5",
            "binary_version": "49~alpha-2ubuntu2.1"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:26.04:LTS",
        "name": "evince",
        "purl": "pkg:deb/ubuntu/evince@49~alpha-2ubuntu2.1?arch=source\u0026distro=resolute"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "49~alpha-2ubuntu2.1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "48.1-3ubuntu2",
        "49~alpha-2",
        "49~alpha-2ubuntu2"
      ]
    },
    {
      "ecosystem_specific": {
        "binaries": [
          {
            "binary_name": "gir1.2-evince-3.0",
            "binary_version": "48.1+dfsg-1build1"
          },
          {
            "binary_name": "libevdocument3-4t64",
            "binary_version": "48.1+dfsg-1build1"
          },
          {
            "binary_name": "libevview3-3t64",
            "binary_version": "48.1+dfsg-1build1"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:26.04:LTS",
        "name": "evince-gtk3",
        "purl": "pkg:deb/ubuntu/evince-gtk3@48.1+dfsg-1build1?arch=source\u0026distro=resolute"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "48.1+dfsg-1build1"
      ]
    },
    {
      "ecosystem_specific": {
        "availability": "No subscription required",
        "binaries": [
          {
            "binary_name": "gir1.2-papers-4.0",
            "binary_version": "50.1-0ubuntu1.1"
          },
          {
            "binary_name": "libppsdocument-4.0-6",
            "binary_version": "50.1-0ubuntu1.1"
          },
          {
            "binary_name": "libppsview-4.0-5",
            "binary_version": "50.1-0ubuntu1.1"
          },
          {
            "binary_name": "papers",
            "binary_version": "50.1-0ubuntu1.1"
          },
          {
            "binary_name": "papers-common",
            "binary_version": "50.1-0ubuntu1.1"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:26.04:LTS",
        "name": "papers",
        "purl": "pkg:deb/ubuntu/papers@50.1-0ubuntu1.1?arch=source\u0026distro=resolute"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "50.1-0ubuntu1.1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "48.0-1ubuntu1",
        "49.1-1ubuntu1",
        "49.2-1ubuntu1",
        "49.2-3ubuntu1",
        "50~beta-0ubuntu2",
        "50.0-0ubuntu1",
        "50.0-0ubuntu2",
        "50.1-0ubuntu1"
      ]
    }
  ],
  "aliases": [],
  "details": "Atril Document Viewer is the default document reader of the MATE desktop environment for Linux. A single-click remote code execution vulnerability in versions prior to 1.26.3 and 1.28.4 allows an attacker to achieve arbitrary code execution as the user by tricking them into clicking a link inside a malicious PDF document. The PDF can be packaged as a polyglot file that is simultaneously a valid PDF and a valid ELF shared library, making the attack a single-file, single-click, configuration-independent RCE on stock atril installations. The root cause is `shell/ev-application.c:ev_spawn`, which builds a command line from attacker-controlled PDF link-destination fields without applying `g_shell_quote`. The cmdline is then handed to `g_app_info_create_from_commandline`, which shell-parses it back into argv \u2014 splitting any embedded `--gtk-module=PATH` into a separate argv element. GTK then `dlopen()`s the path during init, running any `__attribute__((constructor))` it finds. Versions 1.26.3 and 1.28.4 contain a patch for the issue. This is the same defect class as CVE-2023-51698 (CBT `--checkpoint-action` injection in `comics-document.c`, fixed in 1.6.2) but in a different code path (`shell/ev-application.c`) that the original patch did not touch.",
  "id": "UBUNTU-CVE-2026-46529",
  "modified": "2026-06-30T16:22:50Z",
  "published": "2026-05-20T00:00:00Z",
  "references": [
    {
      "type": "REPORT",
      "url": "https://ubuntu.com/security/CVE-2026-46529"
    },
    {
      "type": "REPORT",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-46529"
    },
    {
      "type": "REPORT",
      "url": "https://www.openwall.com/lists/oss-security/2026/05/19/34"
    },
    {
      "type": "REPORT",
      "url": "https://medeiros.zip/posts/CVE-2026-46529-evince"
    },
    {
      "type": "REPORT",
      "url": "https://blogs.gnome.org/mcatanzaro/2026/05/21/single-click-code-execution-exploit-for-evince-atril-and-xreader/"
    },
    {
      "type": "ADVISORY",
      "url": "https://ubuntu.com/security/notices/USN-8295-1"
    },
    {
      "type": "ADVISORY",
      "url": "https://ubuntu.com/security/notices/USN-8321-1"
    }
  ],
  "related": [
    "USN-8295-1",
    "USN-8321-1"
  ],
  "schema_version": "1.7.0",
  "severity": [
    {
      "score": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
      "type": "CVSS_V4"
    },
    {
      "score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    },
    {
      "score": "medium",
      "type": "Ubuntu"
    }
  ],
  "upstream": [
    "CVE-2026-46529"
  ]
}

WID-SEC-W-2026-1641

Vulnerability from csaf_certbund - Published: 2026-05-21 22:00 - Updated: 2026-06-16 22:00

Summary

Evince: Schwachstelle ermöglicht Codeausführung

Severity

Hoch

Notes

Das BSI ist als Anbieter für die eigenen, zur Nutzung bereitgestellten Inhalte nach den allgemeinen Gesetzen verantwortlich. Nutzerinnen und Nutzer sind jedoch dafür verantwortlich, die Verwendung und/oder die Umsetzung der mit den Inhalten bereitgestellten Informationen sorgfältig im Einzelfall zu prüfen.

Produktbeschreibung: Evince ist ein Dokumentenbetrachter und ist als freie Software unter der GNU General Public License (GPL) verbreitet.

Angriff: Ein entfernter, anonymer Angreifer kann eine Schwachstelle in Evince ausnutzen, um beliebigen Programmcode auszuführen.

Betroffene Betriebssysteme: - Linux - UNIX - Windows

CVE-2026-46529

Affected products

Known affected 6 products

Product	Identifier	Version
Debian Linux Debian	`cpe:/o:debian:debian_linux:-`	—
SUSE Linux SUSE	`cpe:/o:suse:suse_linux:-`	—
Ubuntu Linux Ubuntu	`cpe:/o:canonical:ubuntu_linux:-`	—
Open Source Evince <48.4 Open Source / Evince		<48.4
Amazon Linux 2 Amazon	`cpe:/o:amazon:linux_2:-`	—
SUSE openSUSE SUSE	`cpe:/o:suse:opensuse:-`	—

References

15 references

URL	Category
https://wid.cert-bund.de/.well-known/csaf/white/2…	self
https://wid.cert-bund.de/portal/wid/securityadvis…	self
https://gitlab.gnome.org/GNOME/evince/-/work_items/2153	external
https://blogs.gnome.org/mcatanzaro/2026/05/21/sin…	external
https://github.com/N1et/CVE-2026-46529	external
https://lists.debian.org/debian-security-announce…	external
https://lists.debian.org/debian-lts-announce/2026…	external
https://lists.debian.org/debian-lts-announce/2026…	external
https://lists.opensuse.org/archives/list/security…	external
https://ubuntu.com/security/notices/USN-8295-1	external
https://lists.suse.com/pipermail/sle-security-upd…	external
https://lists.suse.com/pipermail/sle-security-upd…	external
https://lists.suse.com/pipermail/sle-security-upd…	external
https://alas.aws.amazon.com/AL2/ALAS2MATE-DESKTOP…	external
https://lists.debian.org/debian-lts-announce/2026…	external

JSON

To clipboard

{
  "document": {
    "aggregate_severity": {
      "text": "hoch"
    },
    "category": "csaf_base",
    "csaf_version": "2.0",
    "distribution": {
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "de-DE",
    "notes": [
      {
        "category": "legal_disclaimer",
        "text": "Das BSI ist als Anbieter f\u00fcr die eigenen, zur Nutzung bereitgestellten Inhalte nach den allgemeinen Gesetzen verantwortlich. Nutzerinnen und Nutzer sind jedoch daf\u00fcr verantwortlich, die Verwendung und/oder die Umsetzung der mit den Inhalten bereitgestellten Informationen sorgf\u00e4ltig im Einzelfall zu pr\u00fcfen."
      },
      {
        "category": "description",
        "text": "Evince ist ein Dokumentenbetrachter und ist als freie Software unter der GNU General Public License (GPL) verbreitet.",
        "title": "Produktbeschreibung"
      },
      {
        "category": "summary",
        "text": "Ein entfernter, anonymer Angreifer kann eine Schwachstelle in Evince ausnutzen, um beliebigen Programmcode auszuf\u00fchren.",
        "title": "Angriff"
      },
      {
        "category": "general",
        "text": "- Linux\n- UNIX\n- Windows",
        "title": "Betroffene Betriebssysteme"
      }
    ],
    "publisher": {
      "category": "other",
      "contact_details": "csaf-provider@cert-bund.de",
      "name": "Bundesamt f\u00fcr Sicherheit in der Informationstechnik",
      "namespace": "https://www.bsi.bund.de"
    },
    "references": [
      {
        "category": "self",
        "summary": "WID-SEC-W-2026-1641 - CSAF Version",
        "url": "https://wid.cert-bund.de/.well-known/csaf/white/2026/wid-sec-w-2026-1641.json"
      },
      {
        "category": "self",
        "summary": "WID-SEC-2026-1641 - Portal Version",
        "url": "https://wid.cert-bund.de/portal/wid/securityadvisory?name=WID-SEC-2026-1641"
      },
      {
        "category": "external",
        "summary": "Evince Gitlab Issue 2153 vom 2026-05-21",
        "url": "https://gitlab.gnome.org/GNOME/evince/-/work_items/2153"
      },
      {
        "category": "external",
        "summary": "Michael Catanzaro\u0027s Blog vom 2026-05-21",
        "url": "https://blogs.gnome.org/mcatanzaro/2026/05/21/single-click-code-execution-exploit-for-evince-atril-and-xreader/"
      },
      {
        "category": "external",
        "summary": "PoC CVE-2026-46529 vom 2026-05-21",
        "url": "https://github.com/N1et/CVE-2026-46529"
      },
      {
        "category": "external",
        "summary": "Debian Security Advisory DSA-6286 vom 2026-05-22",
        "url": "https://lists.debian.org/debian-security-announce/2026/msg00197.html"
      },
      {
        "category": "external",
        "summary": "Debian Security Advisory DLA-4596 vom 2026-05-22",
        "url": "https://lists.debian.org/debian-lts-announce/2026/05/msg00041.html"
      },
      {
        "category": "external",
        "summary": "Debian Security Advisory DLA-4597 vom 2026-05-22",
        "url": "https://lists.debian.org/debian-lts-announce/2026/05/msg00042.html"
      },
      {
        "category": "external",
        "summary": "openSUSE Security Update OPENSUSE-SU-2026:10853-1 vom 2026-05-25",
        "url": "https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/5JGMIW4RPOJ2UYKDD4W7OWEI4SLY6AXQ/"
      },
      {
        "category": "external",
        "summary": "Ubuntu Security Notice USN-8295-1 vom 2026-05-22",
        "url": "https://ubuntu.com/security/notices/USN-8295-1"
      },
      {
        "category": "external",
        "summary": "SUSE Security Update SUSE-SU-2026:2235-1 vom 2026-06-04",
        "url": "https://lists.suse.com/pipermail/sle-security-updates/2026-June/026580.html"
      },
      {
        "category": "external",
        "summary": "SUSE Security Update SUSE-SU-2026:2232-1 vom 2026-06-04",
        "url": "https://lists.suse.com/pipermail/sle-security-updates/2026-June/026583.html"
      },
      {
        "category": "external",
        "summary": "SUSE Security Update SUSE-SU-2026:2288-1 vom 2026-06-05",
        "url": "https://lists.suse.com/pipermail/sle-security-updates/2026-June/026597.html"
      },
      {
        "category": "external",
        "summary": "Amazon Linux Security Advisory ALAS2MATE-DESKTOP1.X-2026-011 vom 2026-06-08",
        "url": "https://alas.aws.amazon.com/AL2/ALAS2MATE-DESKTOP1.X-2026-011.html"
      },
      {
        "category": "external",
        "summary": "Debian Security Advisory DLA-4632 vom 2026-06-16",
        "url": "https://lists.debian.org/debian-lts-announce/2026/06/msg00021.html"
      }
    ],
    "source_lang": "en-US",
    "title": "Evince: Schwachstelle erm\u00f6glicht Codeausf\u00fchrung",
    "tracking": {
      "current_release_date": "2026-06-16T22:00:00.000+00:00",
      "generator": {
        "date": "2026-06-17T08:45:24.109+00:00",
        "engine": {
          "name": "BSI-WID",
          "version": "1.6.0"
        }
      },
      "id": "WID-SEC-W-2026-1641",
      "initial_release_date": "2026-05-21T22:00:00.000+00:00",
      "revision_history": [
        {
          "date": "2026-05-21T22:00:00.000+00:00",
          "number": "1",
          "summary": "Initiale Fassung"
        },
        {
          "date": "2026-05-25T22:00:00.000+00:00",
          "number": "2",
          "summary": "Neue Updates von Debian, openSUSE und Ubuntu aufgenommen"
        },
        {
          "date": "2026-06-04T22:00:00.000+00:00",
          "number": "3",
          "summary": "Neue Updates von SUSE aufgenommen"
        },
        {
          "date": "2026-06-07T22:00:00.000+00:00",
          "number": "4",
          "summary": "Neue Updates von SUSE aufgenommen"
        },
        {
          "date": "2026-06-08T22:00:00.000+00:00",
          "number": "5",
          "summary": "Neue Updates von Amazon aufgenommen"
        },
        {
          "date": "2026-06-16T22:00:00.000+00:00",
          "number": "6",
          "summary": "Neue Updates von Debian aufgenommen"
        }
      ],
      "status": "final",
      "version": "6"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "category": "product_name",
            "name": "Amazon Linux 2",
            "product": {
              "name": "Amazon Linux 2",
              "product_id": "398363",
              "product_identification_helper": {
                "cpe": "cpe:/o:amazon:linux_2:-"
              }
            }
          }
        ],
        "category": "vendor",
        "name": "Amazon"
      },
      {
        "branches": [
          {
            "category": "product_name",
            "name": "Debian Linux",
            "product": {
              "name": "Debian Linux",
              "product_id": "2951",
              "product_identification_helper": {
                "cpe": "cpe:/o:debian:debian_linux:-"
              }
            }
          }
        ],
        "category": "vendor",
        "name": "Debian"
      },
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "\u003c48.4",
                "product": {
                  "name": "Open Source Evince \u003c48.4",
                  "product_id": "T054491"
                }
              },
              {
                "category": "product_version",
                "name": "48.4",
                "product": {
                  "name": "Open Source Evince 48.4",
                  "product_id": "T054491-fixed",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:evince:evince:48.4"
                  }
                }
              }
            ],
            "category": "product_name",
            "name": "Evince"
          }
        ],
        "category": "vendor",
        "name": "Open Source"
      },
      {
        "branches": [
          {
            "category": "product_name",
            "name": "SUSE Linux",
            "product": {
              "name": "SUSE Linux",
              "product_id": "T002207",
              "product_identification_helper": {
                "cpe": "cpe:/o:suse:suse_linux:-"
              }
            }
          },
          {
            "category": "product_name",
            "name": "SUSE openSUSE",
            "product": {
              "name": "SUSE openSUSE",
              "product_id": "T054587",
              "product_identification_helper": {
                "cpe": "cpe:/o:suse:opensuse:-"
              }
            }
          }
        ],
        "category": "vendor",
        "name": "SUSE"
      },
      {
        "branches": [
          {
            "category": "product_name",
            "name": "Ubuntu Linux",
            "product": {
              "name": "Ubuntu Linux",
              "product_id": "T054629",
              "product_identification_helper": {
                "cpe": "cpe:/o:canonical:ubuntu_linux:-"
              }
            }
          }
        ],
        "category": "vendor",
        "name": "Ubuntu"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2026-46529",
      "product_status": {
        "known_affected": [
          "2951",
          "T002207",
          "T054629",
          "T054491",
          "398363",
          "T054587"
        ]
      },
      "release_date": "2026-05-21T22:00:00.000+00:00",
      "title": "CVE-2026-46529"
    }
  ]
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.

Action not permitted

CVE-2026-46529 (GCVE-0-2026-46529)

ubuntu-cve-2026-46529

Vulnerability from osv_ubuntu

WID-SEC-W-2026-1641

Tags

Sightings

Nomenclature