Critical Security Update for Evince Package: CVE-2026-46529
Summary
RHSA-2026:46467: Red Hat Security Advisory: evince security update. Affects evince versions < 0:3.28.4-16.el8_6.1. Fixed in 0:3.28.4-16.el8_6.1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Evince is a document viewer for multiple document formats, including PDF and PostScript. It is widely used in various Linux distributions, particularly in Red Hat environments. The package provides a user-friendly interface and supports features like annotations and bookmarks. However, a recent vulnerability has been identified that could potentially compromise the security of systems using this package.
Vulnerability Detail
The vulnerability, identified as CVE-2026-46529, arises from improper handling of certain document formats within the Evince application. This flaw could allow an attacker to execute arbitrary code on the affected system by crafting a malicious document. The ramifications of this vulnerability are severe, as it could lead to unauthorized access, data breaches, or system compromise. The CVSS score for this vulnerability is 7.8, indicating a high level of risk.
How To Fix
Minimum fixed version
0:3.28.4-16.el8_6.1
This is the first release that contains the fix.
sudo dnf update evinceTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users are advised to avoid opening untrusted documents with Evince until the package is updated. Additionally, consider using alternative document viewers that do not exhibit this vulnerability.
Conclusion
The CVE-2026-46529 vulnerability in the Evince package poses a significant risk to users. It is crucial to update to the patched version to mitigate potential threats. Users should remain vigilant and consider using tools like Vulert for real-time monitoring of vulnerabilities in their software.
See every vulnerability recorded for evince →
FAQ
CVE-2026-46529 is a security vulnerability in the Evince document viewer that allows for arbitrary code execution through malicious documents.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
The vulnerability could lead to unauthorized access, data breaches, or complete system compromise, making it critical to address.
Yes, a patch is available in version 0:3.28.4-16.el8_6.1 of the Evince package.
If immediate updates are not possible, avoid opening untrusted documents with Evince and consider using alternative document viewers.
Related vulnerabilities
Recent vulnerabilities recorded for evince.
