Most recent entries from all

ALSA-2026:27819 — Important: evince security update

Affected: AlmaLinux:9: evince, AlmaLinux:9: evince-libs, AlmaLinux:9: evince-nautilus, AlmaLinux:9: evince-previewer, AlmaLinux:9: evince-thumbnailer

The evince packages provide a simple multi-page document viewer for Portable Document Format (PDF), PostScript (PS), Encapsulated PostScript (EPS) files, and, with additional back-ends, also the Device Independent File format (DVI) files.

Security Fix(es):

* atril: evince: xreader: PDF /GoToR action argv injection enables single-click RCE via --gtk-module dlopen (CVE-2026-46529)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

EUVD-2026-341927

fkie_cve-2026-46529

Atril Document Viewer is the default document reader of the MATE desktop environment for Linux. A single-click remote code execution vulnerability in versions prior to 1.26.3 and 1.28.4 allows an attacker to achieve arbitrary code execution as the user by tricking them into clicking a link inside a malicious PDF document. The PDF can be packaged as a polyglot file that is simultaneously a valid PDF and a valid ELF shared library, making the attack a single-file, single-click, configuration-independent RCE on stock atril installations. The root cause is `shell/ev-application.c:ev_spawn`, which builds a command line from attacker-controlled PDF link-destination fields without applying `g_shell_quote`. The cmdline is then handed to `g_app_info_create_from_commandline`, which shell-parses it back into argv — splitting any embedded `--gtk-module=PATH` into a separate argv element. GTK then `dlopen()`s the path during init, running any `__attribute__((constructor))` it finds. Versions 1.26.3 and 1.28.4 contain a patch for the issue. This is the same defect class as CVE-2023-51698 (CBT `--checkpoint-action` injection in `comics-document.c`, fixed in 1.6.2) but in a different code path (`shell/ev-application.c`) that the original patch did not touch.

OESA-2026-2766 — evince security update

Affected: openEuler:20.03-LTS-SP4: evince, openEuler:22.03-LTS-SP4: evince, openEuler:24.03-LTS-SP1: evince, openEuler:24.03-LTS-SP3: evince

Evince is a document viewer for multiple document formats. The goal of evince is to replace the multiple document viewers that exist on the GNOME Desktop with a single simple application. Evince is specifically designed to support the file following formats: PDF, Postscript, djvu, tiff, dvi, XPS, SyncTex support with gedit, comics books (cbr,cbz,cb7 and cbt). Security Fix(es):

openSUSE-SU-2026:10853-1 — libppsdocument4_0-6-50.1-2.1 on GA media

libppsdocument4_0-6-50.1-2.1 on GA media

RHSA-2026:33416 — Red Hat Security Advisory: evince security update

atril: evince: xreader: PDF /GoToR action argv injection enables single-click RCE via --gtk-module dlopen

RLSA-2026:27819 — Important: evince security update

Affected: Rocky Linux:9: evince

Security Fix(es):

* atril: evince: xreader: PDF /GoToR action argv injection enables single-click RCE via --gtk-module dlopen (CVE-2026-46529)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

SUSE-SU-2026:22182-1 — Security update for papers

Security update for papers

UBUNTU-CVE-2026-46529

Affected: Ubuntu:16.04:LTS: evince, Ubuntu:18.04:LTS: evince, Ubuntu:Pro:18.04:LTS: atril, Ubuntu:20.04:LTS: evince, Ubuntu:Pro:20.04:LTS: atril, Ubuntu:22.04:LTS: evince, Ubuntu:Pro:22.04:LTS: atril, Ubuntu:24.04:LTS: evince, Ubuntu:Pro:24.04:LTS: atril, Ubuntu:25.10: atril and 6 more

WID-SEC-W-2026-1641 — Evince: Schwachstelle ermöglicht Codeausführung

Ein entfernter, anonymer Angreifer kann eine Schwachstelle in Evince ausnutzen, um beliebigen Programmcode auszuführen.