ZDI-26-715: Linux Mint Xreader PDF File Parsing Type Confusion Remote Code Execution Vulnerability
ZDI disclosed CVE-2026-19772, a PDF type confusion flaw (CVSS 7.8) in Linux Mint Xreader allowing remote code execution via malicious files.
ZDI-26-715 describes a type confusion vulnerability when Linux Mint Xreader parses PDF files, allowing remote code execution. Exploitation requires user interaction, such as visiting a malicious page or opening a malicious file. The flaw is tracked as CVE-2026-19772 with a CVSS score of 7.8.
- Type confusion in Xreader PDF parsing leads to arbitrary code execution
- CVSS 7.8; user interaction required (malicious page or file)
- CVEs
- CVE-2026-19772
- Products
- Xreader
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-19772 | — | — | — |
From the original article
This vulnerability allows remote attackers to execute arbitrary code on affected installations of Linux Mint Xreader. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The ZDI has assigned a CVSS rating of 7.
zerodayinitiative.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.