Critical Remote Code Execution Vulnerability in Evince Package
Summary
ALSA-2026:28998: Important: evince security update. Affects evince versions < 3.28.4-17.el8_10. Fixed in 3.28.4-17.el8_10. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Evince is a multi-page document viewer designed for various file formats, including PDF, PostScript, and DVI. It is widely used in Linux distributions, particularly AlmaLinux, for its simplicity and efficiency in handling document viewing tasks. However, a recent security vulnerability has been identified that could potentially allow remote code execution through specially crafted PDF files.
Vulnerability Detail
The vulnerability, identified as CVE-2026-46529, arises from an argv injection in the PDF/GoToR action of the Evince package. This flaw enables an attacker to execute arbitrary code on the victim's machine with a single click, provided the user opens a malicious PDF file. The risk is particularly high because it can be exploited through the --gtk-module dlopen command, which is commonly used in various applications. The implications of this vulnerability are severe, as it could lead to unauthorized access and control over the affected systems.
How To Fix
Minimum fixed version
3.28.4-17.el8_10
This is the first release that contains the fix.
sudo dnf update evinceTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users are advised to avoid opening PDF files from untrusted sources until the package is updated. Additionally, disabling the execution of GTK modules can mitigate the risk of exploitation.
Conclusion
The Evince package has a critical vulnerability that could allow remote code execution through malicious PDF files. Users are strongly encouraged to update their packages to the latest secure version to mitigate this risk. Awareness and prompt action are essential to maintaining system security.
See every vulnerability recorded for evince →
FAQ
CVE-2026-46529 is a security vulnerability in the Evince package that allows for remote code execution through specially crafted PDF files.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without any signup.
If you cannot update the package right away, avoid opening PDF files from untrusted sources and consider disabling GTK module execution as a temporary measure.
While this advisory pertains to AlmaLinux, similar vulnerabilities may exist in other distributions that use the Evince package. Always check for updates from your distribution's maintainers.
Exploitation of this vulnerability could lead to unauthorized access, data theft, or complete control over the affected system, making it critical to address promptly.
Related vulnerabilities
Recent vulnerabilities recorded for evince.
