Atril Document Viewer is the default document reader of the MATE desktop environment for Linux. A single-click remote code execution vulnerability in versions prior to 1.26.3 and 1.28.4 allows an attacker to achieve arbitrary code execution as the user by tricking them into clicking a link inside a malicious PDF document. The PDF can be packaged as a polyglot file that is simultaneously a valid PDF and a valid ELF shared library, making the attack a single-file, single-click, configuration-independent RCE on stock atril installations. The root cause is shell/ev-application.c:evspawn, which builds a command line from attacker-controlled PDF link-destination fields without applying gshellquote. The cmdline is then handed to gappinfocreatefromcommandline, which shell-parses it back into argv — splitting any embedded --gtk-module=PATH into a separate argv element. GTK then dlopen()s the path during init, running any attribute((constructor)) it finds. Versions 1.26.3 and 1.28.4 contain a patch for the issue. This is the same defect class as CVE-2023-51698 (CBT --checkpoint-action injection in comics-document.c, fixed in 1.6.2) but in a different code path (shell/ev-application.c) that the original patch did not touch.

Atril Document Viewer is the default document reader of the MATE desktop environment for Linux. A single-click remote code execution vulnerability in versions prior to 1.26.3 and 1.28.4 allows an attacker to achieve arbitrary code execution as the user by tricking them into clicking a link inside a malicious PDF document. The PDF can be packaged as a polyglot file that is simultaneously a valid PDF and a valid ELF shared library, making the attack a single-file, single-click, configuration-independent RCE on stock atril installations. The root cause is shell/ev-application.c:evspawn, which builds a command line from attacker-controlled PDF link-destination fields without applying gshellquote. The cmdline is then handed to gappinfocreatefromcommandline, which shell-parses it back into argv — splitting any embedded --gtk-module=PATH into a separate argv element. GTK then dlopen()s the path during init, running any attribute((constructor)) it finds. Versions 1.26.3 and 1.28.4 contain a patch for the issue. This is the same defect class as CVE-2023-51698 (CBT --checkpoint-action injection in comics-document.c, fixed in 1.6.2) but in a different code path (shell/ev-application.c) that the original patch did not touch.

Version-Release number of selected component (if applicable): e.g. mate-settings-daemon-1.5.3-1.fc8

mate-settings-daemon's datetime mechanism provides a D-Bus method to set the timezone, which is guarded by polkit's action org.mate.settingsdaemon.datetimemechanism.settimezone; this has the default policy "authselfkeep", which allows any local user to perform the operation with only knowing their own password.

This seems not to be currently exposed in the mate UI, but it is available through manual D-Bus calls, e.g. dbus-send --system --print-reply --type=methodcall --dest=org.mate.SettingsDaemon.DateTimeMechanism / org.mate.SettingsDaemon.DateTimeMechanism.SetTimezone string:/usr/share/zoneinfo/Cuba

Because the time zone setting is a global resource, it should be restricted to system administrators (== root or users in the "wheel" group), by having a policy authadmin. That's also what the other timezone setting mechanisms (in systemd and control-center) do.

This vulnerability allows remote attackers to execute arbitrary code on affected installations of MATE Desktop Atril Document Viewer. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The ZDI has assigned a CVSS rating of 7.8.

Hi,

CVE-2026-46529 is a command injection vulnerability in Evince, Atril, and Xreader caused by missing quoting of shell-like input in evspawn() in ev-application.c. It is fixed by: • Evince 48.2 • Atril 1.28.4 and 1.26.3 • Xreader 4.6.4 and 3.6.7 The fixes for the issue are public in all three projects' git repos [1] [2] [3]. Distros, please start preparing updates immediately.

This bug also affects Papers [4], but it's probably not urgent to update Papers.

I'm doing a little experiment here: although the vulnerability itself is now public because those commits are public and because this is a public mailing list, I have nevertheless decided to keep the original issue reports and CVE details private until Thursday, May 21, because they contain a working exploit developed by a LLM. Perhaps that's arguably stretching the rules of this mailing list slightly, but hopefully this is OK since the flaw and the fix are both public.

I know this is not a standard embargo strategy. And the date is also very soon, leaving you not much time to react. I don't know if this was actually a good idea or not. Complaints welcome! My goal was to make it easy to prepare immediate distro updates without waiting for an embargo to end, while also not releasing the full exploit immediately. I expect people will surely figure out how to abuse this vulnerability shortly after I send this mail, but I'm hoping that attempts to do so will be initially less effective than what we'll release on Thursday.

[1] https://gitlab.gnome.org/GNOME/evince/-/commit/970c219e861a5fcc3e7b9e05bedf18cf0de39245 [2] https://github.com/mate-desktop/atril/commit/b989b7922a454ed81f8bb14786a958828513f576 [3] https://github.com/linuxmint/xreader/commit/50052eaa91c3c750c51c245799e3747495feeece [4] https://gitlab.gnome.org/GNOME/papers/-/commit/1b82bf627b4d8b414a57b55a9095e6d361799d6c

Hello,

The full reports for this vulnerability are available now:

Atril: https://github.com/mate-desktop/atril/security/advisories/GHSA-vgv2-m826-8f6f Evince: https://gitlab.gnome.org/GNOME/evince/-/workitems/2153

They contain a script for building malicious polyglot PDFs that are simultaneously both valid PDF files and also valid ELF binaries. When the user opens the PDF in the PDF viewer and clicks on a malicious link embedded in the PDF, the PDF abuses the command injection vulnerability to load itself as a GTK module using the --gtk-module command line flag. It can then execute arbitrary code via its library constructor. That flag was removed in GTK 4, which is why the vulnerability is much less serious for Papers than it is for Evince, Atril, and Xreader.

The provided script requires that the attacker predict the absolute path that the malicious PDF file will be saved to, generally /home/username/Downloads/attackerchosenname.pdf. However, in a follow-up comment on the Atril advisory, the reporter says that it's possible to modify the script to avoid the requirement to predict the file path.

My takeaway from this incident: AI tools are going to find a lot of vulnerabilities in the short term. A human inspecting this code should have been able to find the command injection vulnerability, but that requires time and effort, so nobody did. Running an AI and telling it to inspect the code is much easier. We're probably in for a rough time in the short term. But in the long term, we are going to be much more secure than we were before, so this is good.

Also, the AI is able to take an investigation much farther than a human would be willing to, crafting a creative working exploit when a human would have almost certainly just stopped after finding the vulnerability. This is unusual and dangerous, but the silver lining is it helps us appreciate the severity of the issue. It's often hard to assess how bad a vulnerability is. If not for the weaponized exploit, I would have thought this bug was not very scary and treated it as not a big deal. But the AI was clever and found a way to make it extremely scary! I don't know how much prompting the human reporter had to do to get this result.

Michael

Hi, Wolfgang

Am 21.05.26 um 15:34 schrieb Michael Catanzaro: Hello,

The full reports for this vulnerability are available now: Evince: https://gitlab.gnome.org/GNOME/evince/-/workitems/2153

Michael

This vulnerability allows remote attackers to execute arbitrary code on affected installations of MATE Desktop Atril Document Viewer. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The ZDI has assigned a CVSS rating of 7.8. The following CVEs are assigned: CVE-2026-52849.

This vulnerability allows remote attackers to execute arbitrary code on affected installations of MATE Desktop Atril Document Viewer. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The ZDI has assigned a CVSS rating of 7.8. The following CVEs are assigned: CVE-2026-52849.