PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-46529 mate-desktop CVE debrief

CVE-2026-46529 is a high-severity remote code execution vulnerability in Atril Document Viewer, a default document reader for the MATE desktop environment. The vulnerability, rated 8.4 CVSS, allows an attacker to execute arbitrary code as the user by tricking them into clicking a link inside a malicious PDF document. The PDF can be packaged as a polyglot file that is simultaneously a valid PDF and a valid ELF shared library, making the attack a single-file, single-click, configuration-independent RCE on stock atril installations. The root cause is `shell/ev-application.c:ev_spawn`, which builds a command line from attacker-controlled PDF link-destination fields without applying `g_shell_quote`. The cmdline is then handed to `g_app_info_create_from_commandline`, which shell-parses it back into argv — splitting any embedded `--gtk-module=PATH` into a separate argv element. GTK then `dlopen()`s the path during init, running any `__attribute__((constructor))` it finds. Versions 1.26.3 and 1.28.4 contain a patch for the issue.

Vendor
mate-desktop
Product
atril
CVSS
HIGH 8.4
CISA KEV
Not listed in stored evidence
Original CVE published
2026-06-10
Original CVE updated
2026-07-28
Advisory published
2026-06-10
Advisory updated
2026-07-28

Who should care

Users of Atril Document Viewer versions prior to 1.26.3 and 1.28.4, particularly those using the MATE desktop environment, should apply the patches or upgrade to a fixed version to prevent exploitation.

Technical summary

The vulnerability exists in the `shell/ev-application.c:ev_spawn` function, where a command line is built from attacker-controlled PDF link-destination fields without proper quoting. This allows an attacker to inject malicious commands, which are then executed when the user clicks on a link in a malicious PDF document.

Defensive priority

High

Recommended defensive actions

  • Apply patches or upgrade to Atril Document Viewer versions 1.26.3 or 1.28.4
  • Use caution when clicking on links in PDF documents
  • Consider using alternative document viewers

Evidence notes

The vulnerability was reported by security researchers and patched by the Atril development team. The CVE record and NVD detail provide additional information on the vulnerability.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-46529 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-46529

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-46529 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-46529

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.