CVE-2026-46529

Evince is a document viewer for multiple document formats. The goal of evince is to replace the multiple document viewers that exist on the GNOME Desktop with a single simple application. Evince is specifically designed to support the file following formats: PDF, Postscript, djvu, tiff, dvi, XPS, SyncTex support with gedit, comics books (cbr,cbz,cb7 and cbt).

Security Fix(es):

Atril Document Viewer is the default document reader of the MATE desktop environment for Linux. A single-click remote code execution vulnerability in versions prior to 1.26.3 and 1.28.4 allows an attacker to achieve arbitrary code execution as the user by tricking them into clicking a link inside a malicious PDF document. The PDF can be packaged as a polyglot file that is simultaneously a valid PDF and a valid ELF shared library, making the attack a single-file, single-click, configuration-independent RCE on stock atril installations. The root cause is shell/ev-application.c:ev_spawn, which builds a command line from attacker-controlled PDF link-destination fields without applying g_shell_quote. The cmdline is then handed to g_app_info_create_from_commandline, which shell-parses it back into argv — splitting any embedded --gtk-module=PATH into a separate argv element. GTK then dlopen()s the path during init, running any __attribute__((constructor)) it finds. Versions 1.26.3 and 1.28.4 contain a patch for the issue. This is the same defect class as CVE-2023-51698 (CBT --checkpoint-action injection in comics-document.c, fixed in 1.6.2) but in a different code path (shell/ev-application.c) that the original patch did not touch.(CVE-2026-46529)

The evince packages provide a simple multi-page document viewer for Portable Document Format (PDF), PostScript (PS), Encapsulated PostScript (EPS) files, and, with additional back-ends, also the Device Independent File format (DVI) files.

Security Fix(es):

• atril: evince: xreader: PDF /GoToR action argv injection enables single-click RCE via --gtk-module dlopen (CVE-2026-46529)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

The evince packages provide a simple multi-page document viewer for Portable Document Format (PDF), PostScript (PS), Encapsulated PostScript (EPS) files, and, with additional back-ends, also the Device Independent File format (DVI) files.

Security Fix(es):

• atril: evince: xreader: PDF /GoToR action argv injection enables single-click RCE via --gtk-module dlopen (CVE-2026-46529)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Atril Document Viewer is the default document reader of the MATE desktop environment for Linux. A single-click remote code execution vulnerability in versions prior to 1.26.3 and 1.28.4 allows an attacker to achieve arbitrary code execution as the user by tricking them into clicking a link inside a malicious PDF document. The PDF can be packaged as a polyglot file that is simultaneously a valid PDF and a valid ELF shared library, making the attack a single-file, single-click, configuration-independent RCE on stock atril installations. The root cause is shell/ev-application.c:ev_spawn, which builds a command line from attacker-controlled PDF link-destination fields without applying g_shell_quote. The cmdline is then handed to g_app_info_create_from_commandline, which shell-parses it back into argv — splitting any embedded --gtk-module=PATH into a separate argv element. GTK then dlopen()s the path during init, running any __attribute__((constructor)) it finds. Versions 1.26.3 and 1.28.4 contain a patch for the issue. This is the same defect class as CVE-2023-51698 (CBT --checkpoint-action injection in comics-document.c, fixed in 1.6.2) but in a different code path (shell/ev-application.c) that the original patch did not touch.

The evince packages provide a simple multi-page document viewer for Portable Document Format (PDF), PostScript (PS), Encapsulated PostScript (EPS) files, and, with additional back-ends, also the Device Independent File format (DVI) files.

Security Fix(es):

• atril: evince: xreader: PDF /GoToR action argv injection enables single-click RCE via --gtk-module dlopen (CVE-2026-46529)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

The evince packages provide a simple multi-page document viewer for Portable Document Format (PDF), PostScript (PS), Encapsulated PostScript (EPS) files, and, with additional back-ends, also the Device Independent File format (DVI) files.

Security Fix(es):

• atril: evince: xreader: PDF /GoToR action argv injection enables single-click RCE via --gtk-module dlopen (CVE-2026-46529)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

• CVE-2026-46529: fix single-click RCE via /GoToR action argv injection by quoting the page-label, named-dest and search-string arguments passed to ev_spawn (backport of upstream 970c219e)

• rebuild for tuxcare9.6esu (CVE-2026-46529)

Evince/Atril/Xreader command injection. (CVE-2026-46529)

These are all security issues fixed in the libppsdocument4_0-6-50.1-2.1 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the libxreaderdocument3-4.6.5-1.1 package on the GA media of openSUSE Tumbleweed.

This update for evince fixes the following issues:

Changes in evince:

• Update to version 48.2 (bsc#1265880 CVE-2026-46529):

  • shell: Quote strings in arguments used when calling ev_spawn

• Update to version 48.1+6:

  • build: bump DjVuLibre version required
  • libview: Fix crash in the accessible code when page cache text is NULL
  • po: Fix xml element in Hindi translation
  • Updated translations.

This update for papers fixes the following issues

Security issue:

• CVE-2026-46529: command injection (bsc#1265880).

Changes for papers:

• Update to version 48.10 (bsc#1265880):
• Update to version 48.9 (jsc#PED-15957, bsc#1261947):
• Bug fixes:
• Saved image files are empty
• Print dialog says "Manage Custom Sizes" for Paper Size every time
• libview: Correct zoom in odd left dual page mode
• Scrolling in presentation mode skips pages

• Changes in version 48.8:
• Bug fixes:

• Ctrl+F sometimes does not focus search box when query is blank
• Page number is not in the center of the number box
• Keyboard input unresponsive in presentation mode, unable to exit with Esc
• help: Update icon

• Changes in version 48.7:

• Fixes for the nautilus plugin filename encodings
• shell: Fix signing when the rectangle is too small
• libdocument: fix weak page references
• shell: Fix opening PDFs from GVFS mounts like Google Drive

• Changes in version 48.6:
• Bug fixed:

• Fix various memory leak
• Fix several focus issues
• Remove trailing new lines from section names
• Migrate to xz compression and manual service run
• Update to version 48.5:

• Bugs fixed:

• Preview for a link doesn't work more than once
• Link preview triggers even after the cursor leaves the link
• shell: fix a translation issue in printing
• libview/pps-view: Ignore the scroll offset when drawing the sign area
• Selection performance
• libview: deal with large pages
• shell: Make sure that all child widgets of PpsView are removed when closing document
• Caret selection doesn't cover more than one character

• Updated translations.

• Update to version 48.4:
• shell: Enable digital signing action when document supports
• Documentation still mentions possibility of saving the settings
• Launch target file
• shell: Fix signature banner title
• Slideshow presentation is blurry
• libview/pps-view: Do not replace the sign cursor on drag-less movements
• Saved annotation timestamps tooltips are shown using UTC time in 12-hours format
• Update to version 48.3:
• shell: disable dual-odd-left action when dual mode is disabled.
• libview: Rerender annotation when the icon property is updated
• shell: Display the filename if the document title is only whitespace

This update for papers fixes the following issues

Security issue:

• CVE-2026-46529: command injection (bsc#1265880).

Changes for papers:

• Update to version 48.10 (bsc#1265880):
• Update to version 48.9 (jsc#PED-15957, bsc#1261947):
• Bug fixes:
• Saved image files are empty
• Print dialog says "Manage Custom Sizes" for Paper Size every time
• libview: Correct zoom in odd left dual page mode
• Scrolling in presentation mode skips pages

• Changes in version 48.8:
• Bug fixes:

• Ctrl+F sometimes does not focus search box when query is blank
• Page number is not in the center of the number box
• Keyboard input unresponsive in presentation mode, unable to exit with Esc
• help: Update icon

• Changes in version 48.7:

• Fixes for the nautilus plugin filename encodings
• shell: Fix signing when the rectangle is too small
• libdocument: fix weak page references
• shell: Fix opening PDFs from GVFS mounts like Google Drive

• Changes in version 48.6:
• Bug fixed:

• Fix various memory leak
• Fix several focus issues
• Remove trailing new lines from section names
• Migrate to xz compression and manual service run
• Update to version 48.5:

• Bugs fixed:

• Preview for a link doesn't work more than once
• Link preview triggers even after the cursor leaves the link
• shell: fix a translation issue in printing
• libview/pps-view: Ignore the scroll offset when drawing the sign area
• Selection performance
• libview: deal with large pages
• shell: Make sure that all child widgets of PpsView are removed when closing document
• Caret selection doesn't cover more than one character

• Updated translations.

• Update to version 48.4:
• shell: Enable digital signing action when document supports
• Documentation still mentions possibility of saving the settings
• Launch target file
• shell: Fix signature banner title
• Slideshow presentation is blurry
• libview/pps-view: Do not replace the sign cursor on drag-less movements
• Saved annotation timestamps tooltips are shown using UTC time in 12-hours format
• Update to version 48.3:
• shell: disable dual-odd-left action when dual mode is disabled.
• libview: Rerender annotation when the icon property is updated
• shell: Display the filename if the document title is only whitespace

This update for evince fixes the following issue

• CVE-2026-46529: improper argument sanitization can lead to command injection (bsc#1265880).

This update for evince fixes the following issue

• CVE-2026-46529: improper argument sanitization can lead to command injection (bsc#1265880).

This update for evince fixes the following issue

• CVE-2026-46529: Evince/Atril/Xreader command injection (bsc#1265880).

It was discovered that Evince did not properly sanitize command-line arguments in PDF /GoToR actions. If a user opened a specially crafted PDF file, an attacker could possibly use this issue to execute arbitrary code.

It was discovered that Papers incorrectly handled PDF /GoToR actions. If a user were tricked into opening a specially crafted PDF file, an attacker could use this issue to manipulate command lines and possibly execute arbitrary code.

It was discovered that Atril did not properly sanitize command-line arguments in PDF /GoToR actions. If a user opened a specially crafted PDF file, an attacker could possibly use this issue to execute arbitrary code. (CVE-2026-46529)

It was discovered that Atril incorrectly handled certain PDF files. An attacker could possibly use this issue to cause a denial of service or to execute arbitrary code. This issue only affected Ubuntu 16.04 LTS. (CVE-2019-1010006)

Andy Nguyen discovered that Atril incorrectly handled certain images. An attacker could possibly use this issue to expose sensitive information. This issue only affected Ubuntu 16.04 LTS. (CVE-2019-11459)