PT-2026-42169 · Xlreader+2 · Xreader+2

Published 2026-05-20 · Updated 2026-05-25 · CVE-2026-46529

Positive Technologies (AI Summary)

Name of the Vulnerable Software and Affected Versions Evince versions prior to 48.2 Atril versions prior to 1.26.3 Atril versions prior to 1.28.4 Xreader versions prior to 3.6.7 Xreader versions prior to 4.6.4

Description Command injection is possible when processing PDF /GoToR actions due to missing quoting of shell-like input in the ev spawn() function within shell/ev-application.c. Specifically, three format strings (--page-label=%s, --named-dest=%s, and --find=%s) pass destination values without using g shell quote. An attacker can use spaces in the value to inject new arguments, such as --gtk-module, pointing to a polyglot file—a file that is simultaneously a valid PDF and a valid ELF (Executable and Linkable Format) binary. This allows the attacker to execute arbitrary code via dlopen when GTK3 loads the module. The security check strcmp(application->uri, uri) can be bypassed by appending ?1 to the filename, as g app info launch uris still resolves the path correctly while the string comparison fails.

Recommendations Update Evince to version 48.2 or later. Update Atril to version 1.26.3 or 1.28.4 or later. Update Xreader to version 3.6.7 or 4.6.4 or later.

Related Identifiers

CVE-2026-46529

OPENSUSE-SU-2026:10853-1

USN-8295-1

Affected Products

Atril

Evince

Xreader

References · 16

• https://osv.dev/vulnerability/openSUSE-SU-2026:10853-1 · Vendor Advisory
• https://ubuntu.com/security/notices/USN-8295-1 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2026-46529 · Security Note
• https://osv.dev/vulnerability/UBUNTU-CVE-2026-46529 · Vendor Advisory
• https://ubuntu.com/security/CVE-2026-46529 · Vendor Advisory
• https://osv.dev/vulnerability/USN-8295-1 · Vendor Advisory
• https://blogs.gnome.org/mcatanzaro/2026/05/21/single-click-code-execution-exploit-for-evince-atril-and-xreader · Note
• https://suse.com/security/cve/CVE-2026-46529 · Note
• https://twitter.com/SecureChap/status/2057975981353111684 · Twitter Post
• https://openwall.com/lists/oss-security/2026/05/19/34 · Note
• https://reddit.com/r/CVEWatch/comments/1tn4o94/top_10_trending_cves_25052026 · Reddit Post
• https://twitter.com/julianor/status/2058200081224831145 · Twitter Post
• https://twitter.com/jmedeiros1337/status/2058042288983417038 · Twitter Post
• https://twitter.com/oss_security/status/2057716393240375591 · Twitter Post
• https://medeiros.zip/posts/CVE-2026-46529-evince · Note