Loading story…
A publicly disclosed flaw, CVE-2026-46529, allows single-click remote code execution in Evince-derived document viewers including Atril and Xreader by abusing PDF /GoToR actions. The bug stems from attacker-controlled PDF destination and search fields being interpolated into ev_spawn() and later reparsed by g_app_info_create_from_commandline, letting a malicious document inject a standalone --gtk-module argument. GTK then loads an attacker-controlled shared library, executing its constructor as the local user who opened the file.
Advisories and mailing-list disclosures said the attack can be delivered as a single polyglot file that is both a valid PDF and a valid ELF shared object, making exploitation possible on stock Linux desktop installations without special configuration. Researchers reported proof-of-concept exploitation on Atril, including reverse-shell execution, and noted the issue is a variant of the defect class previously seen in CVE-2023-51698. Maintainers coordinated fixes across Evince, Atril, and Papers, while noting that GTK4-based viewers such as Papers are not vulnerable to the exact --gtk-module loading path because GTK 4 removed that flag, though related command-injection concerns may still remain.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
5 events from the most recent confirmed update back to the earliest known activity.
Follow-up discussion on the Atril advisory said the original exploit's need to predict the absolute save path of the malicious PDF could be removed. This clarified that the attack could be made more practical than initially described.
An oss-sec discussion reported that Fedora updated Atril to version 1.18.5 to remediate CVE-2026-46529. This reflects downstream distribution action following the coordinated disclosure.
Public advisories described how a malicious PDF `/GoToR` action can inject a `--gtk-module` argument and cause GTK to load an attacker-controlled shared library, enabling code execution as the local user. The disclosure included a proof of concept using a PDF/ELF polyglot file accepted both as a PDF and as a shared library.
Fixes for the vulnerability were merged in Evince, Atril, Papers, and related GLib documentation updates as part of the coordinated response. Maintainers noted that GTK4-based viewers are not vulnerable to the exact `--gtk-module` remote-code-execution path.
Maintainers coordinated disclosure of a command-injection flaw in Evince-derived document viewers and assigned CVE-2026-46529 as a shared identifier across affected forks including Evince, Atril, and Xreader. The bug allows attacker-controlled PDF fields to inject command-line arguments during process spawning.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
4 references tracked. Mallory keeps watching after this page renders.
securityonline.info
Open sourcegithub.com
Open sourceseclists.org
Open sourcegitlab.gnome.org
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Security researchers reported multiple previously unknown weaknesses across the PDF ecosystem that can be exploited through crafted documents. Novee Security’s research into *Foxit* and *Apryse* PDF platforms described **13 vulnerability categories** and **16 exploit paths**, including **critical XSS** and **OS command injection**, with “one-click” scenarios where simply opening a document could trigger compromise and potentially enable account takeover or backend command execution. Separately, a high-severity flaw in the widely used *jsPDF* library was disclosed as **CVE-2026-25755** (CVSS **8.8**), enabling **PDF object injection** via improper sanitization in the `addJS` method. By breaking out of the `/JS (...)` string (e.g., injecting `) >> /Action ...`), an attacker can inject arbitrary PDF structures and actions such as `/OpenAction`, potentially triggering behavior even when JavaScript is disabled in the viewer and enabling document manipulation (e.g., altering `/Annots` or `/Signatures`) across different PDF viewers, including lightweight mobile/embedded parsers.
Jun 29, 2026
Two newly cataloged CVEs detail local code execution vulnerabilities in Windows desktop applications **PDF Explorer 1.5.66.2** and **RGui 3.5.0**. **CVE-2018-25217** affects PDF Explorer through a structured exception handler (SEH) overflow in the application's **Custom fields settings** dialog, where malicious data placed in the **Label** field can overwrite SEH records and enable arbitrary code execution. The issue is mapped to `CWE-787` and was published with CVSS v4.0 and v3.1 scoring, alongside references to Exploit-DB, RTT Software, a trial installer, and a VulnCheck advisory. **CVE-2018-25258** affects RGui 3.5.0 through a stack-based buffer overflow in the **GUI preferences** dialog, specifically the **Language for menus and messages** field. The disclosure says an attacker can use SEH-based exploitation to bypass DEP, run a ROP chain that calls `VirtualAlloc`, and achieve arbitrary code execution on the local system. The entry was published with CVSS v4.0 and v3.1 vectors and references to the affected R 3.5.0 Windows binary, Exploit-DB, the R Project website, and a VulnCheck advisory.
Jun 29, 2026
Adobe disclosed two high-severity prototype pollution vulnerabilities in **Acrobat Reader** tracked as `CVE-2026-34621` and `CVE-2026-34622`. Both flaws can lead to arbitrary code execution in the context of the current user if a victim opens a malicious file, making user interaction a required condition for exploitation. Adobe classified both issues under `CWE-1321` and assigned CVSS v3.1 vectors indicating high impact to confidentiality, integrity, and availability. `CVE-2026-34621` affects Acrobat Reader versions `24.001.30356`, `26.001.21367`, and earlier, while `CVE-2026-34622` affects versions `26.001.21411`, `24.001.30360`, `24.001.30362`, and earlier. The disclosures indicate the vulnerabilities were reported to Adobe's PSIRT and published with advisory references, signaling that organizations using Acrobat Reader should identify exposed versions and prioritize updates to reduce the risk of malicious document-based compromise.
Jun 29, 2026