CVE-2026-46529 Enables Single-Click RCE in Evince, Atril, and Xreader

A publicly disclosed flaw, CVE-2026-46529, allows single-click remote code execution in Evince-derived document viewers including Atril and Xreader by abusing PDF /GoToR actions. The bug stems from attacker-controlled PDF destination and search fields being interpolated into ev_spawn() and later reparsed by g_app_info_create_from_commandline, letting a malicious document inject a standalone --gtk-module argument. GTK then loads an attacker-controlled shared library, executing its constructor as the local user who opened the file.

Advisories and mailing-list disclosures said the attack can be delivered as a single polyglot file that is both a valid PDF and a valid ELF shared object, making exploitation possible on stock Linux desktop installations without special configuration. Researchers reported proof-of-concept exploitation on Atril, including reverse-shell execution, and noted the issue is a variant of the defect class previously seen in CVE-2023-51698. Maintainers coordinated fixes across Evince, Atril, and Papers, while noting that GTK4-based viewers such as Papers are not vulnerable to the exact --gtk-module loading path because GTK 4 removed that flag, though related command-injection concerns may still remain.