CVE-2026-46529: Atril Software — Single-Click Remote Code Execution (June 2026)

CVE-2026-46529 — Atril Software

CVE-2026-46529 is a critical vulnerability in Atril software that allows remote code execution (RCE) via a single user click. The flaw is rated critical and, if exploited, grants attackers the ability to run arbitrary code on targeted systems with minimal user interaction. There is no indication yet of active exploitation, but the risk of rapid weaponization is high.

Attack Vector

Attackers exploit CVE-2026-46529 by delivering a specially crafted file or link to a user of vulnerable Atril software. When the user interacts with the malicious payload—requiring only a single click—the attacker’s code executes with the user’s privileges. No further user action is needed. This attack vector bypasses typical user awareness defenses and can be delivered via email, instant messaging, or compromised websites. No known indicators of compromise (IOCs) have been published at this time.

Who Is at Risk

All organizations running Atril software are at risk, regardless of region or deployment model. The vulnerability affects all supported versions of Atril unless patched. Both enterprise and individual deployments are vulnerable. Atril is confirmed as the affected vendor; organizations using Atril in production environments should prioritize immediate action.

Patch & Mitigate

• Patch: Apply the latest security update from Atril as soon as possible. Check the vendor’s advisory for version-specific details and patch deadlines.
• Workaround: No effective workaround is available. Disable file preview or restrict opening files from untrusted sources as a temporary measure.
• Detect: Monitor logs for unexpected process launches by the Atril application, and review network traffic for suspicious outbound connections following user file interactions.

MITRE ATT&CK

• TA0001 — Initial Access: Attackers gain initial access through user interaction with a malicious file or link.
• TA0002 — Execution: The vulnerability enables direct execution of attacker-supplied code upon user click.

Source: https://securityonline.info/atril-single-click-rce-cve-2026-46529/