Ubuntu USN-8839-1 Fixes Atril Vulnerabilities
Tech GuruQuick Answer
USN-8839-1 fixes Atril's handling of PDF /GoToR actions, which could permit code execution when a crafted file is opened. The two older CVEs in the notice have narrower scope: Ubuntu lists them only for 16.04. Do not read the combined CVE list as three identical exposures on every release.
Confirm Scope And Apply The Supported Fix
What to do now: update the Ubuntu-packaged atril viewer for the installed release, then close and reopen affected sessions after saving work. Defer unknown PDFs until the updated viewer is in use; checking a package transaction alone does not validate an existing process.
Last verified: October 2, 2026 UTC against Ubuntu's notice. No viewer or exploit test was performed.
Scope And Authority
| Product scope | Atril vulnerabilities on Ubuntu 26.04 LTS (resolute), Ubuntu 24.04 LTS (noble), Ubuntu 22.04 LTS (jammy), Ubuntu 20.04 ESM (focal), Ubuntu 18.04 ESM (bionic), Ubuntu 16.04 ESM (xenial) |
|---|---|
| Advisory | USN-8839-1 |
| CVEs | CVE-2019-1010006, CVE-2019-11459, CVE-2026-46529 |
| Authoritative release date | 2026-09-28 15:12:25.943125 UTC |
| Authority revision date | No separate material revision date is stated by Ubuntu; verified against the first-party notice API. |
| Affected versions | The Ubuntu releases and source packages enumerated in USN-8839-1: Ubuntu 26.04 LTS (resolute), Ubuntu 24.04 LTS (noble), Ubuntu 22.04 LTS (jammy), Ubuntu 20.04 ESM (focal), Ubuntu 18.04 ESM (bionic), Ubuntu 16.04 ESM (xenial). |
| Fixed version | bionic: atril 1.20.1-2ubuntu2+esm3 / focal: atril 1.24.0-1ubuntu0.2+esm1 / jammy: atril 1.26.0-1ubuntu1.2+esm1 / noble: atril 1.26.2-3ubuntu0.1~esm1 / resolute: atril 1.28.2-1ubuntu0.1~esm1 / xenial: atril 1.12.2-1ubuntu0.3+esm1 |
| CVSS base score | Not provided by the authority |
| CVSS severity | Not provided by the authority |
| Exploitation status | Not stated by the authority; no exploitation claim is inferred. |
What Changed
CVE-2026-46529 concerns insufficient command-line argument sanitization in PDF actions. For Ubuntu 16.04, CVE-2019-1010006 additionally covers PDF handling with denial-of-service or code-execution risk, and CVE-2019-11459 covers image handling that could disclose information. The notice does not state exploitation in the wild.
What To Validate Now
- Match release and package. Check Atril on the six listed Ubuntu streams; use per-CVE scope rather than assuming all three apply identically.
- Install supported binaries. Obtain the release-specific Atril update through the approved Ubuntu/ESM channel, including related installed packages selected by the resolver.
- Relaunch and compare. Open a known benign PDF and image-bearing document in the updated viewer. Check rendering, navigation and printing if used; never use an untrusted exploit document as a production acceptance test.
- Retain proof. Keep package versions, session restart and document-test results. Record unsupported or separately bundled viewer copies as exceptions, not as repaired by the host update.
Operational Cautions
Some listed fixes are delivered through Ubuntu Pro or ESM. Confirm entitlement and repository state before the change, use the exact supported release stream, and test dependent services, clusters, and rollback. Severity alone is not evidence of exploitation.
Evidence To Retain
- Exact product, release stream, package or application version, enabled feature, environment, and accountable owner.
- UTC timestamps, authority revision, approved change record, installer or package-manager output, and resulting version.
- Relevant logs and monitoring evidence, test results, exceptions, compensating controls, and rollback decisions.
Related TechGeeks Resources
Authoritative References
Correction policy: If the authority changes affected versions, fixed versions, severity, exploitation information, mitigations, or required action, TechGeeks will update this notice and its verification date.
