CVE-2026-46529

RCE via PDF argv injection CVE-2026-46529 atril/xreader/evince Working proof-of-concept for the argv injection in evspawn shell/ev-application.c. A single click anywhere on the rendered page of a crafted PDF triggers arbitrary code execution as the user running the viewer. This release uses the...

Rocky Linux 9.6 [TuxCare] Security Update: evince / evince-devel / evince-dvi / evince-libs / evince-nautilus / etc (ALMALINUX9.6:CLSA-2026:1782819496)

The Rocky Linux 9.6 host has packages installed that are affected by a vulnerability as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1782819496 advisory. - Atril Document Viewer is the default document reader of the MATE desktop environment for Linux. A single- click remote code execution...

AlmaLinux 9.2 [TuxCare] Security Update: evince / evince-devel / evince-dvi / evince-libs / evince-nautilus / etc (ALMALINUX9.2:CLSA-2026:1782485183)

The AlmaLinux 9.2 host has packages installed that are affected by a vulnerability as referenced in the TuxCare ALMALINUX9.2:CLSA-2026:1782485183 advisory. - Atril Document Viewer is the default document reader of the MATE desktop environment for Linux. A single- click remote code execution...

AlmaLinux 9.6 [TuxCare] Security Update: evince / evince-devel / evince-dvi / evince-libs / evince-nautilus / etc (ALMALINUX9.6:CLSA-2026:1782819496)

The AlmaLinux 9.6 host has packages installed that are affected by a vulnerability as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1782819496 advisory. - Atril Document Viewer is the default document reader of the MATE desktop environment for Linux. A single- click remote code execution...

CLSA-2026-1782485183 evince: Fix of CVE-2026-46529

CVE-2026-46529: fix single-click RCE via /GoToR action argv injection by quoting the page-label, named-dest and search-string arguments passed to evspawn backport of upstream 970c219e...

Oracle Linux 8 : evince (ELSA-2026-28998)

The remote Oracle Linux 8 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2026-28998 advisory. - Fix CVE-2026-46529: quote string arguments passed to evspawn Tenable has extracted the preceding description block directly from the Oracle Linux security...

evince security update

3.28.4-17 - Fix CVE-2026-46529: quote string arguments passed to evspawn - Resolves: RHEL-184039...

ALPINE-CVE-2026-46529

Atril Document Viewer is the default document reader of the MATE desktop environment for Linux. A single-click remote code execution vulnerability in versions prior to 1.26.3 and 1.28.4 allows an attacker to achieve arbitrary code execution as the user by tricking them into clicking a link inside...

CVE-2026-46529: Improper Neutralization of Special Elements used in a Command

Atril Document Viewer is the default document reader of the MATE desktop environment for Linux. A single-click remote code execution vulnerability in versions prior to 1.26.3 and 1.28.4 allows an attacker to achieve arbitrary code execution as the user by tricking them into clicking a link inside...