Loading vulnerability…
Single-click code execution via PDF argument injection in Evince, Atril, and Xreader
CVE-2026-46529 is an argument-injection vulnerability in Evince and derived document viewers, including Atril and Xreader. The ev_spawn() function interpolates attacker-controlled PDF destination and search values into a command line without applying g_shell_quote(). When g_app_info_create_from_commandline() reparses that string into arguments, crafted values in a PDF /GoToR action can inject a separate --gtk-module argument. In affected GTK3-based viewers, GTK loads the attacker-selected shared library, executing its constructor with the document viewer user's privileges. A single PDF/ELF polyglot can serve as both the document and the executable library, enabling code execution after the user opens the document and clicks its malicious link. GTK4-based viewers lack the relevant module-loading option and are not susceptible to this exact code-execution technique, although related argument-injection flaws also affect Papers.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation enables arbitrary code execution with the privileges of the user running the document viewer, potentially compromising that user's accessible data, modifying files, and disrupting applications or services within that security context. The demonstrated exploit can establish a reverse shell. Exploitation does not inherently grant root privileges. Public proof-of-concept exploits are available.
If you can’t patch tonight, do this now.
Until patched, do not open untrusted PDFs in affected viewers, and avoid following links embedded in externally supplied documents. Route untrusted PDFs to a supported, patched viewer and review default document-opening associations. Avoiding embedded-link interaction blocks the demonstrated trigger but does not replace installing the security update.
Patch, then assume compromise.
Install distribution security updates or upgrade to a fixed upstream release: Evince 48.2; Atril 1.26.3 or 1.28.4, as appropriate for the maintained branch; or Xreader 3.6.7 or 4.6.4, as appropriate for the maintained branch. Debian trixie supplies an Atril fix in package version 1.26.2-4+deb13u1. Ubuntu provides updates through USN-8839-1. The code-level fix quotes attacker-controlled argument values with g_shell_quote() before constructing the command line passed to g_app_info_create_from_commandline(). Apply the corresponding fix to other affected forks, including Papers.
2 exploits validated by Mallory's analysis.
31 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.