Skip to content
Critical Evince Command Injection Vulnerability Discovered in Ubuntu

Critical Evince Command Injection Vulnerability Discovered in Ubuntu

First seen 22 May 2026, 20:40 UTC • •
API

Article Content

Browse articles
ThreatCluster AI
ThreatCluster •May 23, 2026 at 20:03 UTC
  • •Evince vulnerability allows arbitrary code execution via specially crafted PDF files.
  • •Affected Ubuntu versions include 26.04 LTS, 25.10, 24.04 LTS, and 22.04 LTS.
  • •Users should update their systems immediately to mitigate the risk.

A critical vulnerability has been identified in Evince, the document viewer for Ubuntu, which could allow attackers to execute arbitrary code by opening a specially crafted PDF file. This issue arises from improper sanitization of command-line arguments in PDF /GoToR actions. Affected versions include Ubuntu 26.04 LTS, 25.10, 24.04 LTS, and 22.04 LTS. Users are advised to update their systems to the latest package versions to mitigate the risk. The vulnerability poses a significant threat as it could lead to unauthorized program execution under the user's login. A standard system update will apply the necessary fixes. The issue was disclosed in Ubuntu Security Notice USN-8295-1, published on May 22, 2026.

Start a free Starter trial for enhanced analysis

Ask AI about this cluster

Updated 120d ago How this analysis works

Timeline

2026-05-22
Evince vulnerability disclosed
Ubuntu Security Notice USN-8295-1 announced a critical command injection vulnerability in Evince affecting multiple Ubuntu versions.
Ubuntu
2026-05-22
Linuxsecurity reports on vulnerability
Linuxsecurity published details on the Evince vulnerability, confirming its impact on various Ubuntu releases.
Linuxsecurity

More articles in this cluster (2)

Following this threat?

Track Ubuntu in your own feed — you're alerted when they show up in new reporting, leak sites or exploitation.

Free account · no card needed

Extracted Entities (4)

1 / 3