CVE-2023-51698criticalCWE-78

CVE-2023-51698: critical vulnerability in mate-desktop atril

Atril's CBT comic book parsing vulnerable to Remote Code Execution

Published · Updated

Follow this CVE+ Monitor atril+ Monitor evince

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

28Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 9.6epss 2.4%
Atril is a simple multi-page document viewer. Atril is vulnerable to a critical Command Injection Vulnerability. This vulnerability gives the attacker immediate access to the target system when the target user opens a crafted document or clicks on a crafted link/URL using a maliciously crafted CBT document which is a TAR archive. A patch is available at commit ce41df6.
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:L
Affected products
mate-desktop · atril
Related CVEs — mate-desktop atril

In the same product, most dangerous first.

CVE-2023-52076HIGHRemote Code Execution Vulnerability in Atril's EPUB ebook parsingEPSS 1.1%CVE-2026-46529HIGHPDF /GoToR action argv injection enables single-click RCE via --gtk-module dlopenEPSS 0.5%