CVE catalog

CVE-2026-46529

Atril Document Viewer is the default document reader of the MATE desktop environment for Linux. A single-click remote code execution vulnerability in versions prior to 1.26.3 and 1.28.4 allows an atta

[CVE catalog]

Severity
High · CVSS 8.4CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Published
Source
[NVD] · [CVE record]
EPSS
0.53% · Oct 27, 2026

Atril Document Viewer is the default document reader of the MATE desktop environment for Linux. A single-click remote code execution vulnerability in versions prior to 1.26.3 and 1.28.4 allows an attacker to achieve arbitrary code execution as the user by tricking them into clicking a link inside a malicious PDF document. The PDF can be packaged as a polyglot file that is simultaneously a valid PDF and a valid ELF shared library, making the attack a single-file, single-click, configuration-independent RCE on stock atril installations. The root cause is `shell/ev-application.c:ev_spawn`, which builds a command line from attacker-controlled PDF link-destination fields without applying `g_shell_quote`. The cmdline is then handed to `g_app_info_create_from_commandline`, which shell-parses it back into argv — splitting any embedded `--gtk-module=PATH` into a separate argv element. GTK then `dlopen()`s the path during init, running any `__attribute__((constructor))` it finds. Versions 1.26.3 and 1.28.4 contain a patch for the issue. This is the same defect class as CVE-2023-51698 (CBT `--checkpoint-action` injection in `comics-document.c`, fixed in 1.6.2) but in a different code path (`shell/ev-application.c`) that the original patch did not touch.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

DistributionPackageReleaseVersionStatus
Debianatrilsid1.28.4-1fixed
Debianatrilforky1.28.4-1fixed
Debianatriltrixie1.26.2-4+deb13u1fixed
Debianatriltrixie-security1.26.2-4+deb13u1fixed
Debianatrilbookworm1.26.0-2+deb12u4fixed
Debianatrilbookworm-security1.26.0-2+deb12u4fixed
Debianevincesid49~alpha.1-2fixed
Debianevincetrixie48.1-3+deb13u1fixed
Debianevincetrixie-security48.1-3+deb13u1fixed
Debianevincebookworm43.1-2+deb12u1fixed
Debianevincebookworm-security43.1-2+deb12u1fixed
CpeevinceNot reported46.3.1-0ubuntu1.1fixed
Cpeevince-commonNot reported46.3.1-0ubuntu1.1fixed
Cpegir1.2-evince-3.0Not reported46.3.1-0ubuntu1.1fixed
Cpelibevdocument3-4t64Not reported46.3.1-0ubuntu1.1fixed
Cpelibevince-devNot reported46.3.1-0ubuntu1.1fixed
Cpelibevview3-3t64Not reported46.3.1-0ubuntu1.1fixed
CpeatrilNot reported1.26.0-2+deb12u4fixed
CpeevinceNot reported43.1-2+deb12u1fixed
Ubuntuatrilnoble1.26.2-3ubuntu0.1~esm1fixed
Ubuntuatril-commonnoble1.26.2-3ubuntu0.1~esm1fixed
Ubuntugir1.2-atrildocument-1.5.0noble1.26.2-3ubuntu0.1~esm1fixed
Ubuntugir1.2-atrilview-1.5.0noble1.26.2-3ubuntu0.1~esm1fixed
Ubuntulibatrildocument-devnoble1.26.2-3ubuntu0.1~esm1fixed
Ubuntulibatrildocument3t64noble1.26.2-3ubuntu0.1~esm1fixed
Ubuntulibatrilview-devnoble1.26.2-3ubuntu0.1~esm1fixed
Ubuntulibatrilview3t64noble1.26.2-3ubuntu0.1~esm1fixed
Opensusexreadertumbleweed4.6.5-1.1fixed
Opensusepapersleap 16.048.10-160000.1.1fixed
Ubuntuevince22.0440.4-2vulnerable
Ubuntuevince22.0441.2-1vulnerable
Ubuntuevince22.0441.3-1vulnerable
Ubuntuevince22.0441.3-2vulnerable
Ubuntuevince22.0441.3-3vulnerable
Ubuntuevince22.0442~rc-1vulnerable
Ubuntuevince22.0442.0-1vulnerable
Ubuntuevince22.0442.1-1vulnerable
Ubuntuevince22.0442.1-2vulnerable
Ubuntuevince22.0442.1-3vulnerable
Ubuntuevince22.0442.3-0ubuntu1vulnerable
Ubuntuevince22.0442.3-0ubuntu2vulnerable
Ubuntuevince22.0442.3-0ubuntu3vulnerable
Ubuntuevince22.0442.3-0ubuntu3.1vulnerable
Ubuntuevince22.0442.3-0ubuntu3.2fixed
Ubuntuevince24.0445.0-1vulnerable
Ubuntuevince24.0446.0-1vulnerable
Ubuntuevince24.0446.0-1build1vulnerable
Ubuntuevince24.0446.3.1-0ubuntu1vulnerable
Ubuntuevince24.0446.3.1-0ubuntu1.1fixed
Ubuntuevince25.1048.0-1ubuntu1vulnerable
Ubuntuevince25.1048.0-1ubuntu2vulnerable
Ubuntuevince25.1048.1-3ubuntu2vulnerable
Ubuntuevince25.1048.1-3ubuntu2.1fixed
Ubuntuevince26.0448.1-3ubuntu2vulnerable
Ubuntuevince26.0449~alpha-2vulnerable
Ubuntuevince26.0449~alpha-2ubuntu2vulnerable
Ubuntuevince26.0449~alpha-2ubuntu2.1fixed
Susepaperslinux enterprise server 16.048.10-160000.1.1fixed
Susepaperslinux enterprise server for sap applications 16.048.10-160000.1.1fixed
Opensusepaperstumbleweed50.1-2.1fixed

Fixed-version evidence

DistributionPackageTypeReleaseFixed versionUrgencyOriginBugs
Debianatrilsourcesid1.28.4-1not yet assignedNot reported[1139874]
Debianatrilsourceforky1.28.4-1not yet assignedNot reported[1139874]
Debianatrilsourcetrixie1.26.2-4+deb13u1not yet assignedNot reported[1139874]
Debianatrilsourcebookworm1.26.0-2+deb12u4not yet assignedNot reported[1139874]
Debianevincesourcesid49~alpha-3not yet assignedNot reportedNot reported
Debianevincesourcetrixie48.1-3+deb13u1not yet assignedNot reportedNot reported
Debianevincesourcebookworm43.1-2+deb12u1not yet assignedNot reportedNot reported
CpeevincecpeNot reported46.3.1-0ubuntu1.1Not reportedNot reportedNot reported
Cpeevince-commoncpeNot reported46.3.1-0ubuntu1.1Not reportedNot reportedNot reported
Cpegir1.2-evince-3.0cpeNot reported46.3.1-0ubuntu1.1Not reportedNot reportedNot reported
Cpelibevdocument3-4t64cpeNot reported46.3.1-0ubuntu1.1Not reportedNot reportedNot reported
Cpelibevince-devcpeNot reported46.3.1-0ubuntu1.1Not reportedNot reportedNot reported
Cpelibevview3-3t64cpeNot reported46.3.1-0ubuntu1.1Not reportedNot reportedNot reported
CpeatrilcpeNot reported1.26.0-2+deb12u4Not reportedNot reportedNot reported
CpeevincecpeNot reported43.1-2+deb12u1Not reportedNot reportedNot reported
Ubuntuatrildebnoble1.26.2-3ubuntu0.1~esm1Not reportedNot reportedNot reported
Ubuntuatril-commondebnoble1.26.2-3ubuntu0.1~esm1Not reportedNot reportedNot reported
Ubuntugir1.2-atrildocument-1.5.0debnoble1.26.2-3ubuntu0.1~esm1Not reportedNot reportedNot reported
Ubuntugir1.2-atrilview-1.5.0debnoble1.26.2-3ubuntu0.1~esm1Not reportedNot reportedNot reported
Ubuntulibatrildocument-devdebnoble1.26.2-3ubuntu0.1~esm1Not reportedNot reportedNot reported
Ubuntulibatrildocument3t64debnoble1.26.2-3ubuntu0.1~esm1Not reportedNot reportedNot reported
Ubuntulibatrilview-devdebnoble1.26.2-3ubuntu0.1~esm1Not reportedNot reportedNot reported
Ubuntulibatrilview3t64debnoble1.26.2-3ubuntu0.1~esm1Not reportedNot reportedNot reported
Opensusexreaderrpmtumbleweed4.6.5-1.1Not reportedOPENSUSE-SU-2026:11163-1Not reported
Opensusepapersrpmleap 16.048.10-160000.1.1Not reportedOPENSUSE-SU-2026:21106-1Not reported
Ubuntuevincedeb22.0442.3-0ubuntu3.2Not reportedUSN-8295-1Not reported
Ubuntuevincedeb24.0446.3.1-0ubuntu1.1Not reportedUSN-8295-1Not reported
Ubuntuevincedeb25.1048.1-3ubuntu2.1Not reportedUSN-8295-1Not reported
Ubuntuevincedeb26.0449~alpha-2ubuntu2.1Not reportedUSN-8295-1Not reported
Susepapersrpmlinux enterprise server 16.048.10-160000.1.1Not reportedSUSE-SU-2026:22182-1Not reported
Susepapersrpmlinux enterprise server for sap applications 16.048.10-160000.1.1Not reportedSUSE-SU-2026:22182-1Not reported
Opensusepapersrpmtumbleweed50.1-2.1Not reportedOPENSUSE-SU-2026:10853-1Not reported

[Debian bug #1139874]

OpenFactory catalog packages

[Debian 13 (Trixie)]

  • [gir1.2-papers-4.0]Affected

    Source package: [papers]

    Details (2)

    • 48.3-1 · amd64 · trixie

      Affected

      nvd · papers · debian · 13

    • 48.3-1 · arm64 · trixie

      Affected

      nvd · papers · debian · 13

  • [libpapers-dev]Affected

    Source package: [papers]

    Details (2)

    • 48.3-1 · amd64 · trixie

      Affected

      nvd · papers · debian · 13

    • 48.3-1 · arm64 · trixie

      Affected

      nvd · papers · debian · 13

  • [libpapers-doc]Affected

    Source package: [papers]

    Details (2)

    • 48.3-1 · all · trixie

      Affected

      nvd · papers · debian · 13

    • 48.3-1 · all · trixie

      Affected

      nvd · papers · debian · 13

  • [libppsdocument-4.0-5]Affected

    Source package: [papers]

    Details (2)

    • 48.3-1 · amd64 · trixie

      Affected

      nvd · papers · debian · 13

    • 48.3-1 · arm64 · trixie

      Affected

      nvd · papers · debian · 13

  • [libppsview-4.0-4]Affected

    Source package: [papers]

    Details (2)

    • 48.3-1 · amd64 · trixie

      Affected

      nvd · papers · debian · 13

    • 48.3-1 · arm64 · trixie

      Affected

      nvd · papers · debian · 13

  • [papers]Affected
    Details (2)

    • 48.3-1 · amd64 · trixie

      Affected

      nvd · papers · debian · 13

    • 48.3-1 · arm64 · trixie

      Affected

      nvd · papers · debian · 13

  • [papers-common]Affected

    Source package: [papers]

    Details (2)

    • 48.3-1 · all · trixie

      Affected

      nvd · papers · debian · 13

    • 48.3-1 · all · trixie

      Affected

      nvd · papers · debian · 13

[openSUSE Tumbleweed]

  • [libppsdocument4_0-6]Unknown

    Source package: [papers]

    Details (1)

    • 50.2-1.3 · x86_64 · tumbleweed

      Unknown · Fixed: 50.1-2.1

      Version impact unknown

      nvd · papers · opensuse · tumbleweed

  • [libppsview4_0-5]Unknown

    Source package: [papers]

    Details (1)

    • 50.2-1.3 · x86_64 · tumbleweed

      Unknown · Fixed: 50.1-2.1

      Version impact unknown

      nvd · papers · opensuse · tumbleweed

  • [libxreaderdocument3]Unknown

    Source package: [xreader]

    Details (1)

    • 4.6.5-1.3 · x86_64 · tumbleweed

      Unknown · Fixed: 4.6.5-1.1

      Version impact unknown

      nvd · xreader · opensuse · tumbleweed

  • [libxreaderview3]Unknown

    Source package: [xreader]

    Details (1)

    • 4.6.5-1.3 · x86_64 · tumbleweed

      Unknown · Fixed: 4.6.5-1.1

      Version impact unknown

      nvd · xreader · opensuse · tumbleweed

  • [nautilus-extension-papers]Unknown

    Source package: [papers]

    Details (1)

    • 50.2-1.3 · x86_64 · tumbleweed

      Unknown · Fixed: 50.1-2.1

      Version impact unknown

      nvd · papers · opensuse · tumbleweed

  • [papers-devel]Unknown

    Source package: [papers]

    Details (1)

    • 50.2-1.3 · x86_64 · tumbleweed

      Unknown · Fixed: 50.1-2.1

      Version impact unknown

      nvd · papers · opensuse · tumbleweed

  • [papers-lang]Unknown

    Source package: [papers]

    Details (1)

    • 50.2-1.3 · noarch · tumbleweed

      Unknown · Fixed: 50.1-2.1

      Version impact unknown

      nvd · papers · opensuse · tumbleweed

  • [papers-plugin-comicsdocument]Unknown

    Source package: [papers]

    Details (1)

    • 50.2-1.3 · x86_64 · tumbleweed

      Unknown · Fixed: 50.1-2.1

      Version impact unknown

      nvd · papers · opensuse · tumbleweed

  • [papers-plugin-djvudocument]Unknown

    Source package: [papers]

    Details (1)

    • 50.2-1.3 · x86_64 · tumbleweed

      Unknown · Fixed: 50.1-2.1

      Version impact unknown

      nvd · papers · opensuse · tumbleweed

  • [papers-plugin-pdfdocument]Unknown

    Source package: [papers]

    Details (1)

    • 50.2-1.3 · x86_64 · tumbleweed

      Unknown · Fixed: 50.1-2.1

      Version impact unknown

      nvd · papers · opensuse · tumbleweed

  • [papers-plugin-tiffdocument]Unknown

    Source package: [papers]

    Details (1)

    • 50.2-1.3 · x86_64 · tumbleweed

      Unknown · Fixed: 50.1-2.1

      Version impact unknown

      nvd · papers · opensuse · tumbleweed

  • [typelib-1_0-PapersDocument-4_0]Unknown

    Source package: [papers]

    Details (1)

    • 50.2-1.3 · x86_64 · tumbleweed

      Unknown · Fixed: 50.1-2.1

      Version impact unknown

      nvd · papers · opensuse · tumbleweed

  • [typelib-1_0-PapersView-4_0]Unknown

    Source package: [papers]

    Details (1)

    • 50.2-1.3 · x86_64 · tumbleweed

      Unknown · Fixed: 50.1-2.1

      Version impact unknown

      nvd · papers · opensuse · tumbleweed

Next results

Observed:

References

[CERT-Bund public advisories] · [Debian Security Tracker] · [FIRST EPSS] · [National Vulnerability Database (NVD)] · [OSV Package Vulnerability Database] · [Red Hat security advisories and VEX] · [SUSE security advisories and VEX] · [Ubuntu Security Notices (USN)]