Re: Evince/Atril/Xreader command injection CVE-2026-46529

["Michael Catanzaro" <mcatanzaro () gnome org>]

Hello,

The full reports for this vulnerability are available now:

Atril: https://github.com/mate-desktop/atril/security/advisories/GHSA-vgv2-m826-8f6f
Evince: https://gitlab.gnome.org/GNOME/evince/-/work_items/2153

They contain a script for building malicious polyglot PDFs that are simultaneously both valid PDF files and also valid 
ELF binaries. When the user opens the PDF in the PDF viewer and clicks on a malicious link embedded in the PDF, the PDF 
abuses the command injection vulnerability to load itself as a GTK module using the `--gtk-module` command line flag. 
It can then execute arbitrary code via its library constructor. That flag was removed in GTK 4, which is why the 
vulnerability is much less serious for Papers than it is for Evince, Atril, and Xreader.

The provided script requires that the attacker predict the absolute path that the malicious PDF file will be saved to, 
generally /home/username/Downloads/attacker_chosen_name.pdf. However, in a follow-up comment on the Atril advisory, the 
reporter says that it's possible to modify the script to avoid the requirement to predict the file path.

My takeaway from this incident: AI tools are going to find a lot of vulnerabilities in the short term. A human 
inspecting this code should have been able to find the command injection vulnerability, but that requires time and 
effort, so nobody did. Running an AI and telling it to inspect the code is much easier. We're probably in for a rough 
time in the short term. But in the long term, we are going to be much more secure than we were before, so this is good.

Also, the AI is able to take an investigation much farther than a human would be willing to, crafting a creative 
working exploit when a human would have almost certainly just stopped after finding the vulnerability. This is unusual 
and dangerous, but the silver lining is it helps us appreciate the severity of the issue. It's often hard to assess how 
bad a vulnerability is. If not for the weaponized exploit, I would have thought this bug was not very scary and treated 
it as not a big deal. But the AI was clever and found a way to make it extremely scary! I don't know how much prompting 
the human reporter had to do to get this result.

Michael