CVE-2026-46529 Overview
CVE-2026-46529 is a command injection vulnerability in Atril Document Viewer, the default document reader of the MATE desktop environment on Linux. The flaw allows arbitrary code execution as the current user when a victim clicks a link embedded in a malicious PDF. Attackers can package the PDF as a polyglot file that is simultaneously a valid PDF and a valid ELF shared library. The result is a single-file, single-click, configuration-independent remote code execution against stock Atril installations. Versions prior to 1.26.3 and 1.28.4 are affected, and both versions contain the fix.
Critical Impact
A single user click on a crafted PDF link grants attackers arbitrary code execution as the logged-in user, with no additional payload delivery required.
Affected Products
- Atril Document Viewer versions prior to 1.26.3
- Atril Document Viewer versions prior to 1.28.4 (1.28.x branch)
- MATE desktop environment installations on Linux distributions including Debian
Discovery Timeline
- 2026-06-10 - CVE-2026-46529 published to NVD
- 2026-06-10 - Last updated in NVD database
Technical Details for CVE-2026-46529
Vulnerability Analysis
The vulnerability is a command injection flaw [CWE-77] in the Atril shell layer. When a user clicks a link inside a PDF, Atril constructs a command line that incorporates attacker-controlled link-destination fields from the PDF. The constructed command line is then passed to g_app_info_create_from_commandline, which shell-parses the string back into an argv array. Because the destination fields are not escaped before concatenation, an attacker can inject additional command-line arguments. The injected arguments include GTK initialization flags that load arbitrary code at process startup.
Root Cause
The root cause sits in shell/ev-application.c:ev_spawn. That function builds a command line from attacker-controlled PDF link-destination fields without applying g_shell_quote to sanitize the values. Because GLib later shell-parses the string, any whitespace or option-like substring in the attacker's input becomes a distinct argv element. This is the same defect class as CVE-2023-51698, which patched a similar injection in comics-document.c but did not touch this code path.
Attack Vector
An attacker crafts a PDF whose link destination contains an injected --gtk-module=PATH argument. When the victim clicks the link, the shell-parser splits the injected flag into its own argv element. GTK then calls dlopen() on the supplied path during initialization. Any function marked __attribute__((constructor)) in the loaded ELF runs immediately. By building the PDF as a polyglot that is also a valid ELF shared library, the attacker points --gtk-module at the same file the victim already opened, producing a single-click, single-file RCE.
No verified public exploit code is published. See the GitHub Security Advisory GHSA-vgv2-m826-8f6f for additional technical detail.
Detection Methods for CVE-2026-46529
Indicators of Compromise
- PDF files that also contain a valid ELF header, ELF program headers, or .init/.ctors sections — a strong indicator of polyglot weaponization.
- atril processes spawning child processes via g_app_info_create_from_commandline with --gtk-module= substrings in their arguments.
- Unexpected dlopen() calls from atril referencing files under user-writable directories such as /tmp, /home/*/Downloads, or /dev/shm.
Detection Strategies
- Inspect PDF files for embedded ELF magic bytes (\\x7fELF) and flag matches for further analysis.
- Monitor command-line telemetry for atril invocations containing --gtk-module, --gdk-debug, or other GTK initialization flags supplied via document-derived input.
- Alert on atril writing or executing files outside its expected runtime paths, especially shared library loads from $HOME or temporary directories.
Monitoring Recommendations
- Collect process-creation and library-load events from Linux desktops running MATE and forward them to a centralized analytics platform.
- Correlate child process spawns from atril with the PDF source file path to identify when document interaction precedes anomalous execution.
- Track installed Atril package versions across the fleet to identify hosts still running versions earlier than 1.26.3 or 1.28.4.
How to Mitigate CVE-2026-46529
Immediate Actions Required
- Upgrade Atril to version 1.26.3 or 1.28.4 or later on all Linux endpoints running the MATE desktop environment.
- Apply distribution updates such as the Debian LTS packages announced on the debian-lts-announce list.
- Audit endpoints for PDF files received from untrusted sources since early 2026 and quarantine suspected polyglot samples.
Patch Information
The MATE project released fixes in Atril v1.26.3 and Atril v1.28.4. The patch applies g_shell_quote to attacker-controlled fields in shell/ev-application.c:ev_spawn before the command line is handed to g_app_info_create_from_commandline, preventing argument injection. Debian users should install the updates referenced in the Debian LTS Announcement.
Workarounds
- Until patching is complete, configure the desktop environment to open PDF files with a different reader such as Evince or a sandboxed viewer.
- Disable link activation in Atril or instruct users not to click links inside PDFs received from untrusted sources.
- Open untrusted PDFs inside a restricted environment such as a container or Firejail profile that blocks dlopen() of user-writable paths.
# Verify the installed Atril version and apply the vendor update
atril --version
sudo apt update && sudo apt install --only-upgrade atril
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
