Single-Click Code Execution Exploit for Evince, Atril, and Xreader

Published by

blogs.gnome.org

on •1 min read

CVE-2026-46529 is an argument injection vulnerability in Evince, Atril, and Xreader caused by missing shell quoting when composing a command line. The reporter, João Medeiros, has published a GitHub repo for the CVE and a blog post with the story of how he discovered the flaw and developed the...

Fedora GNOME Security Common GLib Programming Errors Best Practices for Build Options Creating Quality Backtraces for Crash Reports On setenv() and Explosions Fedora GNOME Security

Learn more