mate-desktop vulnerabilities

Products

• atril 3
• engrampa 1
• mate-screensaver 1
• mate-settings-daemon 1

Latest mate-desktop CVEs

Newest publication first

1. CVE-2026-46529 PDF /GoToR action argv injection enables single-click RCE via --gtk-module dlopen

   Published 2026-06-10

   High·CVSS 8.4 EPSS 0.53%

   Atril Document Viewer is the default document reader of the MATE desktop environment for Linux. A single-click remote code execution vulnerability in versions prior to 1.26.3 and 1.28.4 allows an attacker to achieve arbitrary code execution as the user by tricking them into click...

2. CVE-2023-52138 Path traversal via crafted cpio archives in Engrampa archivers

   Published 2024-02-05

   Critical·CVSS 9.6 EPSS 1.7%

   Engrampa is an archive manager for the MATE environment. Engrampa is found to be vulnerable to a Path Traversal vulnerability that can be leveraged to achieve full Remote Command Execution (RCE) on the target. While handling CPIO archives, the Engrampa Archive manager follows sym...

3. CVE-2023-52076 Remote Code Execution Vulnerability in Atril's EPUB ebook parsing

   Published 2024-01-25

   High·CVSS 7.8 EPSS 1.1%

   Atril Document Viewer is the default document reader of the MATE desktop environment for Linux. A path traversal and arbitrary file write vulnerability exists in versions of Atril prior to 1.26.2. This vulnerability is capable of writing arbitrary files anywhere on the filesystem...

4. CVE-2023-51698 Atril's CBT comic book parsing vulnerable to Remote Code Execution

   Published 2024-01-12

   High·CVSS 8.8 EPSS 2.4%

   Atril is a simple multi-page document viewer. Atril is vulnerable to a critical Command Injection Vulnerability. This vulnerability gives the attacker immediate access to the target system when the target user opens a crafted document or clicks on a crafted link/URL using a malic...

5. CVE-2018-20681 mate-screensaver before 1.20.2 in MATE Desktop Environment allows physically proximate attackers to view screen content and possibly control applications. By unplugging and re-plugging or power-cyclin...

   Published 2019-01-09

   Medium·CVSS 6.1 EPSS 0.58%

   mate-screensaver before 1.20.2 in MATE Desktop Environment allows physically proximate attackers to view screen content and possibly control applications. By unplugging and re-plugging or power-cycling external output devices (such as additionally attached graphical outputs via H...

6. CVE-2012-5560 The default configuration in mate-settings-daemon 1.5.3 allows local users to change the timezone for the system via a crafted D-Bus call.

   Published 2014-05-30

   Low·CVSS 2.1 EPSS 0.37%

   The default configuration in mate-settings-daemon 1.5.3 allows local users to change the timezone for the system via a crafted D-Bus call.

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.