USN-8839-1: Atril vulnerabilities
Ubuntu patched Atril flaws, including a PDF GoToR bug that crafted files could use to run code.
Ubuntu published USN-8839-1 for vulnerabilities in Atril, the MATE document viewer. CVE-2026-46529 is improper sanitization of command-line arguments in PDF GoToR actions, which a crafted PDF could use to execute code. Two older issues affect only Ubuntu 16.04 LTS: CVE-2019-1010006 may cause denial of service or code execution, and CVE-2019-11459 may expose sensitive information through crafted images. No exploitation is reported.
- CVE-2026-46529: unsanitized PDF GoToR arguments may allow code execution.
- CVE-2019-1010006 affects only Ubuntu 16.04 and may crash Atril or run code.
- CVE-2019-11459 may expose sensitive information via crafted images on 16.04.
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2019-1010006 | Evince 3.26.0 is affected by buffer overflow | 7.8 | 2% | PoC ×2 | |
| CVE-2019-11459 | The tiff_document_render() and tiff_document_get_thumbnail() functions in the TIFF document backend in GNOME Evince through 3.32.0 did not handle errors from… | 5.5 | 1% | ||
| CVE-2026-46529 | Atril Document Viewer: A single-click remote code execution vulnerability in versions prior to 1.26.3 and 1.28.4 allows an attacker to achieve arbitrary… | 8.4 | <1% |
From the original article
It was discovered that Atril did not properly sanitize command-line arguments in PDF /GoToR actions. If a user opened a specially crafted PDF file, an attacker could possibly use this issue to execute arbitrary code. (CVE-2026-46529) It was discovered that Atril incorrectly handled certain PDF files.
ubuntu.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.