Linux Mint Xreader Vulnerability Allows Remote Code Execution via PDF Parsing Flaw
A type confusion vulnerability in Linux Mint's Xreader PDF parsing component, ZDI-26-715, allows remote attackers to execute arbitrary code with a CVSS score of 7.8.
A critical vulnerability has been identified in Linux Mint's Xreader application, specifically within its PDF file parsing capabilities. Tracked as ZDI-26-715, this flaw allows remote attackers to execute arbitrary code on affected systems, posing a significant risk to users who handle PDF documents.
The vulnerability stems from a type confusion issue that arises due to improper validation of user-supplied data during the PDF parsing process. This lack of robust validation enables attackers to manipulate the application's internal state, leading to the execution of malicious code in the context of the currently logged-in user.
Exploitation of this vulnerability requires user interaction. Attackers can trick victims into opening a specially crafted PDF file or visiting a malicious webpage that hosts such a file. Once the user interacts with the malicious content, the vulnerability can be triggered, allowing the attacker to gain control over the affected system.
The Common Vulnerability Scoring System (CVSS) has assigned this vulnerability a score of 7.8, classifying it as High severity. This score reflects the potential impact and ease of exploitation, highlighting the urgency for users to apply available patches.
Linux Mint has addressed this vulnerability by releasing an update for the Xreader application. Users are strongly advised to update their Xreader software to the latest version to mitigate the risk of exploitation. Details of the fix can be found in the commit history on GitHub.
The disclosure timeline indicates that the vulnerability was reported to the vendor on July 16, 2026, with a coordinated public release of the advisory on September 18, 2026. This timeframe aligns with standard responsible disclosure practices, allowing vendors adequate time to develop and distribute patches.
This vulnerability underscores the ongoing risks associated with parsing complex file formats like PDFs. Software that handles user-provided documents, especially those with rich features like PDF, must implement rigorous input validation and secure parsing mechanisms to prevent such vulnerabilities from being exploited.
While the vulnerability was reported by an anonymous researcher, the detailed advisory from the Zero Day Initiative provides crucial technical information for security professionals and users to understand and defend against this threat. The prompt patching by Linux Mint is a positive step in protecting its user base.