Critical Security Update for Evince: Addressing CVE-2026-46529
Summary
RHSA-2026:42692: Red Hat Security Advisory: evince security update. Affects evince versions < 0:3.28.4-16.el8_8.1. Fixed in 0:3.28.4-16.el8_8.1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Evince is a document viewer for multiple document formats, including PDF and PostScript. It is widely used in various Linux distributions, particularly in Red Hat environments. The application is designed to provide a user-friendly interface for viewing and navigating documents. However, it has been found to contain a security vulnerability that could potentially allow unauthorized access to sensitive information.
Vulnerability Detail
The vulnerability identified as CVE-2026-46529 affects the Evince package and its associated components. This issue arises from improper handling of certain document formats, which could lead to arbitrary code execution or information disclosure. Attackers could exploit this vulnerability by crafting malicious documents that, when opened in Evince, could compromise the user's system. The CVSS score for this vulnerability is 7.8, indicating a high severity level.
How To Fix
Minimum fixed version
0:3.28.4-16.el8_8.1
This is the first release that contains the fix.
sudo dnf update evinceTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users are advised to avoid opening untrusted documents in Evince until the package is updated. Additionally, consider using alternative document viewers that do not exhibit this vulnerability.
Conclusion
The Evince security vulnerability CVE-2026-46529 poses a significant risk to users, allowing potential unauthorized access and code execution. It is crucial to update to the patched version to mitigate these risks. Users should remain vigilant and consider alternative document viewers until the update is applied.
See every vulnerability recorded for evince →
FAQ
CVE-2026-46529 is a security vulnerability in the Evince document viewer that could allow unauthorized access to sensitive information or arbitrary code execution.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without requiring any signup.
If you cannot update Evince immediately, avoid opening untrusted documents and consider using alternative document viewers.
Exploiting this vulnerability could lead to unauthorized access to sensitive information or allow attackers to execute arbitrary code on the user's system.
Yes, Vulert provides a service that monitors and alerts in real-time for open-source vulnerabilities using just a manifest file like package-lock.json.
Related vulnerabilities
Recent vulnerabilities recorded for evince.
