Bug 2487899 - CVE-2026-46529 atril: PDF /GoToR action argv injection enables single-click RCE via --gtk-module dlopen [epel-all]
Summary: CVE-2026-46529 atril: PDF /GoToR action argv injection enables single-click R...
Keywords:
Status: CLOSED ERRATA
Alias: None
Product: Fedora EPEL
Classification: Fedora
Component: atril
Version: epel9
Hardware: Unspecified
OS: Unspecified
high
high
Target Milestone: ---
Assignee: Robert Scheck
QA Contact: Fedora Extras Quality Assurance
URL:
Whiteboard: {"flaws": ["b0313110-7598-4a95-9cbd-9...
Depends On:
Blocks: CVE-2026-46529
TreeView+ depends on / blocked
 
Reported: 2026-06-11 13:55 UTC by Guilherme de Almeida Suckevicz
Modified: 2026-06-20 00:56 UTC (History)
3 users (show)

Fixed In Version: atril-1.26.4-1.el9 atril-1.26.4-1.el8
Clone Of:
Environment:
Last Closed: 2026-06-20 00:37:48 UTC
Type: ---
Embargoed:

Attachments (Terms of Use)

Description Guilherme de Almeida Suckevicz 2026-06-11 13:55:35 UTC 
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
Comment 1 Wolfgang Ulbrich 2026-06-11 14:12:47 UTC 
Hi Robert,
please take a look at it. I do not use epel.
Comment 2 Wolfgang Ulbrich 2026-06-11 16:56:51 UTC 
Dear reporter. i do not see any version for epel10 at https://src.fedoraproject.org/rpms/atril
What version do you blame?
Comment 3 Victor Kareh 2026-06-11 17:25:03 UTC 
This issue has been fixed in Atril 1.26.3 (read https://github.com/mate-desktop/atril/security/advisories/GHSA-vgv2-m826-8f6f). Robert can you bump the epel versions?

Also the RH CVE (https://access.redhat.com/security/cve/cve-2026-46529) only shows Evince in the component list table.
Comment 4 Robert Scheck 2026-06-11 18:56:31 UTC 
Yes, I will work on this RHBZ tonight or so.
Comment 5 Fedora Update System 2026-06-11 20:06:19 UTC 
FEDORA-EPEL-2026-abc540be8b (atril-1.26.4-1.el9) has been submitted as an update to Fedora EPEL 9.
https://bodhi.fedoraproject.org/updates/FEDORA-EPEL-2026-abc540be8b
Comment 6 Fedora Update System 2026-06-11 20:06:25 UTC 
FEDORA-EPEL-2026-c0bb6674c7 (atril-1.26.4-1.el8) has been submitted as an update to Fedora EPEL 8.
https://bodhi.fedoraproject.org/updates/FEDORA-EPEL-2026-c0bb6674c7
Comment 7 Fedora Update System 2026-06-12 01:18:51 UTC 
FEDORA-EPEL-2026-abc540be8b has been pushed to the Fedora EPEL 9 testing repository.

You can provide feedback for this update here: https://bodhi.fedoraproject.org/updates/FEDORA-EPEL-2026-abc540be8b

See also https://fedoraproject.org/wiki/QA:Updates_Testing for more information on how to test updates.
Comment 8 Fedora Update System 2026-06-12 01:27:29 UTC 
FEDORA-EPEL-2026-c0bb6674c7 has been pushed to the Fedora EPEL 8 testing repository.

You can provide feedback for this update here: https://bodhi.fedoraproject.org/updates/FEDORA-EPEL-2026-c0bb6674c7

See also https://fedoraproject.org/wiki/QA:Updates_Testing for more information on how to test updates.
Comment 9 Fedora Update System 2026-06-20 00:37:48 UTC 
FEDORA-EPEL-2026-abc540be8b (atril-1.26.4-1.el9) has been pushed to the Fedora EPEL 9 stable repository.
If problem still persists, please make note of it in this bug report.
Comment 10 Fedora Update System 2026-06-20 00:56:47 UTC 
FEDORA-EPEL-2026-c0bb6674c7 (atril-1.26.4-1.el8) has been pushed to the Fedora EPEL 8 stable repository.
If problem still persists, please make note of it in this bug report.
Note You need to log in before you can comment on or make changes to this bug.