UBUNTU-CVE-2026-46529

See a problem?
Please try reporting it to the source first.
Source
https://ubuntu.com/security/CVE-2026-46529
Import Source
https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-46529.json
JSON Data
https://api.test.osv.dev/v1/vulns/UBUNTU-CVE-2026-46529
Upstream
Downstream
Related
Published
2026-05-20T00:00:00Z
Modified
2026-06-17T06:31:21.357538416Z
Severity
  • 8.4 (High) CVSS_V4 - CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N CVSS Calculator
  • Ubuntu - medium
Summary
[none]
Details

Atril Document Viewer is the default document reader of the MATE desktop environment for Linux. A single-click remote code execution vulnerability in versions prior to 1.26.3 and 1.28.4 allows an attacker to achieve arbitrary code execution as the user by tricking them into clicking a link inside a malicious PDF document. The PDF can be packaged as a polyglot file that is simultaneously a valid PDF and a valid ELF shared library, making the attack a single-file, single-click, configuration-independent RCE on stock atril installations. The root cause is shell/ev-application.c:ev_spawn, which builds a command line from attacker-controlled PDF link-destination fields without applying g_shell_quote. The cmdline is then handed to g_app_info_create_from_commandline, which shell-parses it back into argv — splitting any embedded --gtk-module=PATH into a separate argv element. GTK then dlopen()s the path during init, running any __attribute__((constructor)) it finds. Versions 1.26.3 and 1.28.4 contain a patch for the issue. This is the same defect class as CVE-2023-51698 (CBT --checkpoint-action injection in comics-document.c, fixed in 1.6.2) but in a different code path (shell/ev-application.c) that the original patch did not touch.

References

Affected packages

Ubuntu:16.04:LTS
evince

Package

Name
evince
Purl
pkg:deb/ubuntu/evince?arch=source&distro=xenial

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected

Affected versions

3.*
3.16.1-0ubuntu1
3.18.1-1ubuntu1
3.18.1-1ubuntu2
3.18.2-1ubuntu1
3.18.2-1ubuntu2
3.18.2-1ubuntu3
3.18.2-1ubuntu4
3.18.2-1ubuntu4.1
3.18.2-1ubuntu4.2
3.18.2-1ubuntu4.3
3.18.2-1ubuntu4.4
3.18.2-1ubuntu4.5
3.18.2-1ubuntu4.6

Ecosystem specific 

{
    "binaries": [
        {
            "binary_name": "evince",
            "binary_version": "3.18.2-1ubuntu4.6"
        },
        {
            "binary_name": "evince-common",
            "binary_version": "3.18.2-1ubuntu4.6"
        },
        {
            "binary_name": "evince-gtk",
            "binary_version": "3.18.2-1ubuntu4.6"
        },
        {
            "binary_name": "gir1.2-evince-3.0",
            "binary_version": "3.18.2-1ubuntu4.6"
        },
        {
            "binary_name": "libevdocument3-4",
            "binary_version": "3.18.2-1ubuntu4.6"
        },
        {
            "binary_name": "libevview3-3",
            "binary_version": "3.18.2-1ubuntu4.6"
        }
    ]
}

Database specific

source 
"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-46529.json"
Ubuntu:18.04:LTS
evince

Package

Name
evince
Purl
pkg:deb/ubuntu/evince?arch=source&distro=bionic

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected

Affected versions

3.*
3.26.0-1
3.26.0-2
3.26.0-3
3.27.91-1
3.27.92-1
3.28.0-1
3.28.2-1
3.28.4-0ubuntu1
3.28.4-0ubuntu1.1
3.28.4-0ubuntu1.2

Ecosystem specific 

{
    "binaries": [
        {
            "binary_name": "browser-plugin-evince",
            "binary_version": "3.28.4-0ubuntu1.2"
        },
        {
            "binary_name": "evince",
            "binary_version": "3.28.4-0ubuntu1.2"
        },
        {
            "binary_name": "evince-common",
            "binary_version": "3.28.4-0ubuntu1.2"
        },
        {
            "binary_name": "gir1.2-evince-3.0",
            "binary_version": "3.28.4-0ubuntu1.2"
        },
        {
            "binary_name": "libevdocument3-4",
            "binary_version": "3.28.4-0ubuntu1.2"
        },
        {
            "binary_name": "libevview3-3",
            "binary_version": "3.28.4-0ubuntu1.2"
        }
    ]
}

Database specific

source 
"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-46529.json"
Ubuntu:20.04:LTS
evince

Package

Name
evince
Purl
pkg:deb/ubuntu/evince?arch=source&distro=focal

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected

Affected versions

3.*
3.34.1-1
3.34.1-1build1
3.35.1-1
3.35.1-1build1
3.35.92-1
3.36.0-1
3.36.0-2
3.36.5-0ubuntu1
3.36.7-0ubuntu1
3.36.10-0ubuntu1

Ecosystem specific 

{
    "binaries": [
        {
            "binary_name": "evince",
            "binary_version": "3.36.10-0ubuntu1"
        },
        {
            "binary_name": "evince-common",
            "binary_version": "3.36.10-0ubuntu1"
        },
        {
            "binary_name": "gir1.2-evince-3.0",
            "binary_version": "3.36.10-0ubuntu1"
        },
        {
            "binary_name": "libevdocument3-4",
            "binary_version": "3.36.10-0ubuntu1"
        },
        {
            "binary_name": "libevview3-3",
            "binary_version": "3.36.10-0ubuntu1"
        }
    ]
}

Database specific

source 
"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-46529.json"
atril

Package

Name
atril
Purl
pkg:deb/ubuntu/atril?arch=source&distro=focal

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected

Affected versions

1.*
1.22.2-0ubuntu1
1.24.0-0ubuntu1
1.24.0-1
1.24.0-1ubuntu0.1
1.24.0-1ubuntu0.2

Ecosystem specific 

{
    "binaries": [
        {
            "binary_name": "atril",
            "binary_version": "1.24.0-1ubuntu0.2"
        },
        {
            "binary_name": "atril-common",
            "binary_version": "1.24.0-1ubuntu0.2"
        },
        {
            "binary_name": "gir1.2-atril",
            "binary_version": "1.24.0-1ubuntu0.2"
        },
        {
            "binary_name": "gir1.2-atrildocument-1.5.0",
            "binary_version": "1.24.0-1ubuntu0.2"
        },
        {
            "binary_name": "gir1.2-atrilview-1.5.0",
            "binary_version": "1.24.0-1ubuntu0.2"
        },
        {
            "binary_name": "libatrildocument3",
            "binary_version": "1.24.0-1ubuntu0.2"
        },
        {
            "binary_name": "libatrilview3",
            "binary_version": "1.24.0-1ubuntu0.2"
        }
    ]
}

Database specific

source 
"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-46529.json"
Ubuntu:22.04:LTS
atril

Package

Name
atril
Purl
pkg:deb/ubuntu/atril?arch=source&distro=jammy

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected

Affected versions

1.*
1.26.0-0ubuntu1
1.26.0-1ubuntu1
1.26.0-1ubuntu1.1
1.26.0-1ubuntu1.2

Ecosystem specific 

{
    "binaries": [
        {
            "binary_name": "atril",
            "binary_version": "1.26.0-1ubuntu1.2"
        },
        {
            "binary_name": "atril-common",
            "binary_version": "1.26.0-1ubuntu1.2"
        },
        {
            "binary_name": "gir1.2-atrildocument-1.5.0",
            "binary_version": "1.26.0-1ubuntu1.2"
        },
        {
            "binary_name": "gir1.2-atrilview-1.5.0",
            "binary_version": "1.26.0-1ubuntu1.2"
        },
        {
            "binary_name": "libatrildocument3",
            "binary_version": "1.26.0-1ubuntu1.2"
        },
        {
            "binary_name": "libatrilview3",
            "binary_version": "1.26.0-1ubuntu1.2"
        }
    ]
}

Database specific

source 
"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-46529.json"
evince

Package

Name
evince
Purl
pkg:deb/ubuntu/evince?arch=source&distro=jammy

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
42.3-0ubuntu3.2

Affected versions

40.*
40.4-2
41.*
41.2-1
41.3-1
41.3-2
41.3-3
Other
42~rc-1
42.*
42.0-1
42.1-1
42.1-2
42.1-3
42.3-0ubuntu1
42.3-0ubuntu2
42.3-0ubuntu3
42.3-0ubuntu3.1

Ecosystem specific 

{
    "availability": "No subscription required",
    "binaries": [
        {
            "binary_name": "evince",
            "binary_version": "42.3-0ubuntu3.2"
        },
        {
            "binary_name": "evince-common",
            "binary_version": "42.3-0ubuntu3.2"
        },
        {
            "binary_name": "gir1.2-evince-3.0",
            "binary_version": "42.3-0ubuntu3.2"
        },
        {
            "binary_name": "libevdocument3-4",
            "binary_version": "42.3-0ubuntu3.2"
        },
        {
            "binary_name": "libevview3-3",
            "binary_version": "42.3-0ubuntu3.2"
        }
    ]
}

Database specific

source 
"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-46529.json"
Ubuntu:24.04:LTS
atril

Package

Name
atril
Purl
pkg:deb/ubuntu/atril?arch=source&distro=noble

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected

Affected versions

1.*
1.26.0-2fakesync1
1.26.1-1
1.26.1-3
1.26.1-4
1.26.2-1
1.26.2-1.1build3
1.26.2-3build1
1.26.2-3build2

Ecosystem specific 

{
    "binaries": [
        {
            "binary_name": "atril",
            "binary_version": "1.26.2-3build2"
        },
        {
            "binary_name": "atril-common",
            "binary_version": "1.26.2-3build2"
        },
        {
            "binary_name": "gir1.2-atrildocument-1.5.0",
            "binary_version": "1.26.2-3build2"
        },
        {
            "binary_name": "gir1.2-atrilview-1.5.0",
            "binary_version": "1.26.2-3build2"
        },
        {
            "binary_name": "libatrildocument3t64",
            "binary_version": "1.26.2-3build2"
        },
        {
            "binary_name": "libatrilview3t64",
            "binary_version": "1.26.2-3build2"
        }
    ]
}

Database specific

source 
"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-46529.json"
evince

Package

Name
evince
Purl
pkg:deb/ubuntu/evince?arch=source&distro=noble

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
46.3.1-0ubuntu1.1

Affected versions

45.*
45.0-1
46.*
46.0-1
46.0-1build1
46.3.1-0ubuntu1

Ecosystem specific 

{
    "availability": "No subscription required",
    "binaries": [
        {
            "binary_name": "evince",
            "binary_version": "46.3.1-0ubuntu1.1"
        },
        {
            "binary_name": "evince-common",
            "binary_version": "46.3.1-0ubuntu1.1"
        },
        {
            "binary_name": "gir1.2-evince-3.0",
            "binary_version": "46.3.1-0ubuntu1.1"
        },
        {
            "binary_name": "libevdocument3-4t64",
            "binary_version": "46.3.1-0ubuntu1.1"
        },
        {
            "binary_name": "libevview3-3t64",
            "binary_version": "46.3.1-0ubuntu1.1"
        }
    ]
}

Database specific

source 
"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-46529.json"
Ubuntu:25.10
atril

Package

Name
atril
Purl
pkg:deb/ubuntu/atril?arch=source&distro=questing

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected

Affected versions

1.*
1.26.2-4
1.26.2-4build1
1.26.2-5

Ecosystem specific 

{
    "binaries": [
        {
            "binary_name": "atril",
            "binary_version": "1.26.2-5"
        },
        {
            "binary_name": "atril-common",
            "binary_version": "1.26.2-5"
        },
        {
            "binary_name": "gir1.2-atrildocument-1.5.0",
            "binary_version": "1.26.2-5"
        },
        {
            "binary_name": "gir1.2-atrilview-1.5.0",
            "binary_version": "1.26.2-5"
        },
        {
            "binary_name": "libatrildocument3t64",
            "binary_version": "1.26.2-5"
        },
        {
            "binary_name": "libatrilview3t64",
            "binary_version": "1.26.2-5"
        }
    ]
}

Database specific

source 
"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-46529.json"
evince

Package

Name
evince
Purl
pkg:deb/ubuntu/evince?arch=source&distro=questing

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
48.1-3ubuntu2.1

Affected versions

48.*
48.0-1ubuntu1
48.0-1ubuntu2
48.1-3ubuntu2

Ecosystem specific 

{
    "availability": "No subscription required",
    "binaries": [
        {
            "binary_name": "evince",
            "binary_version": "48.1-3ubuntu2.1"
        },
        {
            "binary_name": "evince-common",
            "binary_version": "48.1-3ubuntu2.1"
        },
        {
            "binary_name": "gir1.2-evince-3.0",
            "binary_version": "48.1-3ubuntu2.1"
        },
        {
            "binary_name": "libevdocument3-4t64",
            "binary_version": "48.1-3ubuntu2.1"
        },
        {
            "binary_name": "libevview3-3t64",
            "binary_version": "48.1-3ubuntu2.1"
        }
    ]
}

Database specific

source 
"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-46529.json"
papers

Package

Name
papers
Purl
pkg:deb/ubuntu/papers?arch=source&distro=questing

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
48.0-1ubuntu1.25.10.4

Affected versions

48.*
48.0-1ubuntu1
48.0-1ubuntu1.25.10.1
48.0-1ubuntu1.25.10.2
48.0-1ubuntu1.25.10.3

Ecosystem specific 

{
    "availability": "No subscription required",
    "binaries": [
        {
            "binary_name": "gir1.2-papers-4.0",
            "binary_version": "48.0-1ubuntu1.25.10.4"
        },
        {
            "binary_name": "libppsdocument-4.0-5",
            "binary_version": "48.0-1ubuntu1.25.10.4"
        },
        {
            "binary_name": "libppsview-4.0-4",
            "binary_version": "48.0-1ubuntu1.25.10.4"
        },
        {
            "binary_name": "papers",
            "binary_version": "48.0-1ubuntu1.25.10.4"
        },
        {
            "binary_name": "papers-common",
            "binary_version": "48.0-1ubuntu1.25.10.4"
        }
    ]
}

Database specific

source 
"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-46529.json"
Ubuntu:26.04:LTS
atril

Package

Name
atril
Purl
pkg:deb/ubuntu/atril?arch=source&distro=resolute

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected

Affected versions

1.*
1.26.2-5
1.28.2-1

Ecosystem specific 

{
    "binaries": [
        {
            "binary_name": "atril",
            "binary_version": "1.28.2-1"
        },
        {
            "binary_name": "atril-common",
            "binary_version": "1.28.2-1"
        },
        {
            "binary_name": "gir1.2-atrildocument-1.5.0",
            "binary_version": "1.28.2-1"
        },
        {
            "binary_name": "gir1.2-atrilview-1.5.0",
            "binary_version": "1.28.2-1"
        },
        {
            "binary_name": "libatrildocument3t64",
            "binary_version": "1.28.2-1"
        },
        {
            "binary_name": "libatrilview3t64",
            "binary_version": "1.28.2-1"
        }
    ]
}

Database specific

source 
"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-46529.json"
evince

Package

Name
evince
Purl
pkg:deb/ubuntu/evince?arch=source&distro=resolute

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
49~alpha-2ubuntu2.1

Affected versions

48.*
48.1-3ubuntu2
Other
49~alpha-2
49~alpha-2ubuntu2

Ecosystem specific 

{
    "availability": "No subscription required",
    "binaries": [
        {
            "binary_name": "evince",
            "binary_version": "49~alpha-2ubuntu2.1"
        },
        {
            "binary_name": "evince-common",
            "binary_version": "49~alpha-2ubuntu2.1"
        },
        {
            "binary_name": "gir1.2-evince-4.0",
            "binary_version": "49~alpha-2ubuntu2.1"
        },
        {
            "binary_name": "libevdocument-4.0-6",
            "binary_version": "49~alpha-2ubuntu2.1"
        },
        {
            "binary_name": "libevview-4.0-5",
            "binary_version": "49~alpha-2ubuntu2.1"
        }
    ]
}

Database specific

source 
"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-46529.json"
evince-gtk3

Package

Name
evince-gtk3
Purl
pkg:deb/ubuntu/evince-gtk3?arch=source&distro=resolute

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected

Affected versions

48.*
48.1+dfsg-1build1

Ecosystem specific 

{
    "binaries": [
        {
            "binary_name": "gir1.2-evince-3.0",
            "binary_version": "48.1+dfsg-1build1"
        },
        {
            "binary_name": "libevdocument3-4t64",
            "binary_version": "48.1+dfsg-1build1"
        },
        {
            "binary_name": "libevview3-3t64",
            "binary_version": "48.1+dfsg-1build1"
        }
    ]
}

Database specific

source 
"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-46529.json"
papers

Package

Name
papers
Purl
pkg:deb/ubuntu/papers?arch=source&distro=resolute

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
50.1-0ubuntu1.1

Affected versions

48.*
48.0-1ubuntu1
49.*
49.1-1ubuntu1
49.2-1ubuntu1
49.2-3ubuntu1
Other
50~beta-0ubuntu2
50.*
50.0-0ubuntu1
50.0-0ubuntu2
50.1-0ubuntu1

Ecosystem specific 

{
    "availability": "No subscription required",
    "binaries": [
        {
            "binary_name": "gir1.2-papers-4.0",
            "binary_version": "50.1-0ubuntu1.1"
        },
        {
            "binary_name": "libppsdocument-4.0-6",
            "binary_version": "50.1-0ubuntu1.1"
        },
        {
            "binary_name": "libppsview-4.0-5",
            "binary_version": "50.1-0ubuntu1.1"
        },
        {
            "binary_name": "papers",
            "binary_version": "50.1-0ubuntu1.1"
        },
        {
            "binary_name": "papers-common",
            "binary_version": "50.1-0ubuntu1.1"
        }
    ]
}

Database specific

source 
"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-46529.json"
Ubuntu:Pro:16.04:LTS
atril

Package

Name
atril
Purl
pkg:deb/ubuntu/atril?arch=source&distro=esm-apps%2Fxenial

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected

Affected versions

1.*
1.10.2+repack1-1
1.12.2-1
1.12.2-1ubuntu0.1
1.12.2-1ubuntu0.2
1.12.2-1ubuntu0.3
1.12.2-1ubuntu0.3+esm1

Ecosystem specific 

{
    "binaries": [
        {
            "binary_name": "atril",
            "binary_version": "1.12.2-1ubuntu0.3+esm1"
        },
        {
            "binary_name": "atril-common",
            "binary_version": "1.12.2-1ubuntu0.3+esm1"
        },
        {
            "binary_name": "gir1.2-atril",
            "binary_version": "1.12.2-1ubuntu0.3+esm1"
        },
        {
            "binary_name": "libatrildocument3",
            "binary_version": "1.12.2-1ubuntu0.3+esm1"
        },
        {
            "binary_name": "libatrilview3",
            "binary_version": "1.12.2-1ubuntu0.3+esm1"
        }
    ]
}

Database specific

source 
"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-46529.json"
Ubuntu:Pro:18.04:LTS
atril

Package

Name
atril
Purl
pkg:deb/ubuntu/atril?arch=source&distro=esm-apps%2Fbionic

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected

Affected versions

1.*
1.18.1-1
1.18.3-1
1.19.6-0ubuntu1
1.20.0-0ubuntu1
1.20.1-0ubuntu1
1.20.1-1
1.20.1-2ubuntu1
1.20.1-2ubuntu2
1.20.1-2ubuntu2+esm1
1.20.1-2ubuntu2+esm2

Ecosystem specific 

{
    "binaries": [
        {
            "binary_name": "atril",
            "binary_version": "1.20.1-2ubuntu2+esm2"
        },
        {
            "binary_name": "atril-common",
            "binary_version": "1.20.1-2ubuntu2+esm2"
        },
        {
            "binary_name": "gir1.2-atril",
            "binary_version": "1.20.1-2ubuntu2+esm2"
        },
        {
            "binary_name": "gir1.2-atrildocument-1.5.0",
            "binary_version": "1.20.1-2ubuntu2+esm2"
        },
        {
            "binary_name": "gir1.2-atrilview-1.5.0",
            "binary_version": "1.20.1-2ubuntu2+esm2"
        },
        {
            "binary_name": "libatrildocument3",
            "binary_version": "1.20.1-2ubuntu2+esm2"
        },
        {
            "binary_name": "libatrilview3",
            "binary_version": "1.20.1-2ubuntu2+esm2"
        }
    ]
}

Database specific

source 
"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-46529.json"