CVE-2026-46529 is a command injection vulnerability in Atril Document Viewer, part of the MATE desktop environment for Linux. The flaw arises from improper neutralization of special elements in PDF link-destination fields, which can be exploited to execute arbitrary code with the privileges of the user running Atril. The vulnerability allows single-click remote code execution via malicious PDF links. Affected versions include all versions prior to 1.26.3 and versions from 1.27.0 up to but not including 1.28.4. Red Hat has released security advisories and patches to address this issue in their distributions.

Successful exploitation of this vulnerability allows an attacker to execute arbitrary code on the affected system with the privileges of the user running Atril. This can lead to compromise of the user's environment and potentially further system access depending on user privileges. The vulnerability requires user interaction (single-click) to trigger the exploit. The CVSS 4.0 base score is 8.4, indicating high severity with local attack vector, low attack complexity, no privileges required, user interaction required, and high impact on confidentiality, integrity, and availability.

Red Hat has issued official security advisories and updates that address this vulnerability. Users should apply the provided patches from Red Hat to remediate the issue. Specifically, updating Atril to versions 1.26.3 or later, or to versions 1.28.4 or later, will mitigate the vulnerability. Patch status is confirmed by Red Hat advisories. No additional mitigation steps are indicated beyond applying the official updates.