CVE-2026-46529 PDF /GoToR action argv injection enables single-click RCE via --gtk-module dlopen
Attackers can achieve remote code execution by tricking users into clicking a malicious PDF link, exploiting command line injection in Atril.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Local or same network only
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2026-46529?
CVE-2026-46529 is a high-severity command injection vulnerability in mate-desktop atril, published on 10 Jun 2026. It can only be exploited from the same machine or local network, and only if a user opens a file or follows a link.
Official description
Atril Document Viewer is the default document reader of the MATE desktop environment for Linux. A single-click remote code execution vulnerability in versions prior to 1.26.3 and 1.28.4 allows an attacker to achieve arbitrary code execution as the user by tricking them into clicking a link inside a malicious PDF document. The PDF can be packaged as a polyglot file that is simultaneously a valid PDF and a valid ELF shared library, making the attack a single-file, single-click, configuration-independent RCE on stock atril installations. The root cause is `shell/ev-application.c:ev_spawn`, which builds a command line from attacker-controlled PDF link-destination fields without applying `g_shell_quote`. The cmdline is then handed to `g_app_info_create_from_commandline`, which shell-parses it back into argv — splitting any embedded `--gtk-module=PATH` into a separate argv element. GTK then `dlopen()`s the path during init, running any `__attribute__((constructor))` it finds. Versions 1.26.3 and 1.28.4 contain a patch for the issue. This is the same defect class as CVE-2023-51698 (CBT `--checkpoint-action` injection in `comics-document.c`, fixed in 1.6.2) but in a different code path (`shell/ev-application.c`) that the original patch did not touch.
Which versions are affected by CVE-2026-46529?
Linux distribution packages (40)
evince AlmaLinux:8 | All versions | 3.28.4-17.el8_10 |
evince-browser-plugin AlmaLinux:8 | All versions | 3.28.4-17.el8_10 |
evince-devel AlmaLinux:8 | All versions | 3.28.4-17.el8_10 |
evince-libs AlmaLinux:8 | All versions | 3.28.4-17.el8_10 |
evince-nautilus AlmaLinux:8 | All versions | 3.28.4-17.el8_10 |
evince AlmaLinux:9 | All versions | 40.5-4.el9_8.1 |
evince-libs AlmaLinux:9 | All versions | 40.5-4.el9_8.1 |
evince-nautilus AlmaLinux:9 | All versions | 40.5-4.el9_8.1 |
evince-previewer AlmaLinux:9 | All versions | 40.5-4.el9_8.1 |
evince-thumbnailer AlmaLinux:9 | All versions | 40.5-4.el9_8.1 |
evince Red Hat:enterprise_linux:8::appstream | All versions | 0:3.28.4-17.el8_10 |
evince-browser-plugin Red Hat:enterprise_linux:8::appstream | All versions | 0:3.28.4-17.el8_10 |
evince-browser-plugin-debuginfo Red Hat:enterprise_linux:8::appstream | All versions | 0:3.28.4-17.el8_10 |
evince-debuginfo Red Hat:enterprise_linux:8::appstream | All versions | 0:3.28.4-17.el8_10 |
evince-debugsource Red Hat:enterprise_linux:8::appstream | All versions | 0:3.28.4-17.el8_10 |
evince-libs Red Hat:enterprise_linux:8::appstream | All versions | 0:3.28.4-17.el8_10 |
evince-libs-debuginfo Red Hat:enterprise_linux:8::appstream | All versions | 0:3.28.4-17.el8_10 |
evince-nautilus Red Hat:enterprise_linux:8::appstream | All versions | 0:3.28.4-17.el8_10 |
evince-nautilus-debuginfo Red Hat:enterprise_linux:8::appstream | All versions | 0:3.28.4-17.el8_10 |
evince-browser-plugin-debuginfo Red Hat:enterprise_linux:8::crb | All versions | 0:3.28.4-17.el8_10 |
evince-debuginfo Red Hat:enterprise_linux:8::crb | All versions | 0:3.28.4-17.el8_10 |
evince-debugsource Red Hat:enterprise_linux:8::crb | All versions | 0:3.28.4-17.el8_10 |
evince-devel Red Hat:enterprise_linux:8::crb | All versions | 0:3.28.4-17.el8_10 |
evince-libs-debuginfo Red Hat:enterprise_linux:8::crb | All versions | 0:3.28.4-17.el8_10 |
evince-nautilus-debuginfo Red Hat:enterprise_linux:8::crb | All versions | 0:3.28.4-17.el8_10 |
evince Red Hat:enterprise_linux:9::appstream | All versions | 0:40.5-4.el9_8.1 |
evince-debuginfo Red Hat:enterprise_linux:9::appstream | All versions | 0:40.5-4.el9_8.1 |
evince-debugsource Red Hat:enterprise_linux:9::appstream | All versions | 0:40.5-4.el9_8.1 |
evince-dvi-debuginfo Red Hat:enterprise_linux:9::appstream | All versions | 0:40.5-4.el9_8.1 |
evince-libs Red Hat:enterprise_linux:9::appstream | All versions | 0:40.5-4.el9_8.1 |
evince-libs-debuginfo Red Hat:enterprise_linux:9::appstream | All versions | 0:40.5-4.el9_8.1 |
evince-nautilus Red Hat:enterprise_linux:9::appstream | All versions | 0:40.5-4.el9_8.1 |
evince-nautilus-debuginfo Red Hat:enterprise_linux:9::appstream | All versions | 0:40.5-4.el9_8.1 |
evince-previewer Red Hat:enterprise_linux:9::appstream | All versions | 0:40.5-4.el9_8.1 |
evince-previewer-debuginfo Red Hat:enterprise_linux:9::appstream | All versions | 0:40.5-4.el9_8.1 |
evince-thumbnailer Red Hat:enterprise_linux:9::appstream | All versions | 0:40.5-4.el9_8.1 |
evince-thumbnailer-debuginfo Red Hat:enterprise_linux:9::appstream | All versions | 0:40.5-4.el9_8.1 |
evince Red Hat:rhel_aus:8.4::appstream | All versions | 0:3.28.4-11.el8_4.1 |
evince-browser-plugin Red Hat:rhel_aus:8.4::appstream | All versions | 0:3.28.4-11.el8_4.1 |
evince-browser-plugin-debuginfo Red Hat:rhel_aus:8.4::appstream | All versions | 0:3.28.4-11.el8_4.1 |
How do I fix CVE-2026-46529?
Apply the vendor's patch.
Upgrade, and pass arguments to programs as a list instead of through a shell. More about Command injection.
Is CVE-2026-46529 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-46529 exists.
Public exploit code: 1 proofs of concept on GitHub.
Sources
Also known as ALSA-2026:27819, ALSA-2026:28998, CLSA-2026-1782485183, CLSA-2026-1782819496, DEBIAN-CVE-2026-46529, GHSA-vgv2-m826-8f6f and 24 more.