Critical Security Update for GNU Emacs: Heap Over-read and Shell Command Injection Vulnerabilities
Summary
ALSA-2026:80507: Important: emacs security update. Affects emacs versions < 1:27.2-18.el9_8.2. Fixed in 1:27.2-18.el9_8.2. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
GNU Emacs is a powerful, customizable, self-documenting text editor widely used for programming and text manipulation. It features advanced code editing capabilities, a built-in scripting language (elisp), and functionalities for reading emails and news. However, recent vulnerabilities have been discovered that could compromise user data and system security.
Vulnerability Detail
The vulnerabilities identified in GNU Emacs include a heap over-read that can lead to information disclosure through crafted images (CVE-2026-77219) and a local shell command injection vulnerability via the user field in emacs tramp (CVE-2026-79992). These vulnerabilities can allow attackers to exploit the system, potentially leading to unauthorized access to sensitive information and execution of arbitrary commands.
How To Fix
Minimum fixed version
1:27.2-18.el9_8.2
This is the first release that contains the fix.
sudo dnf update emacsTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary measure, users can disable the features that utilize the vulnerable components until the update is applied. For instance, avoid using tramp for remote file access until the patch is installed.
Conclusion
The recent vulnerabilities in GNU Emacs highlight the importance of keeping software up to date to protect against potential security threats. By applying the necessary updates and following best practices, users can mitigate risks associated with these vulnerabilities.
See every vulnerability recorded for emacs →
FAQ
The vulnerabilities involve a heap over-read and a local shell command injection, which can lead to information disclosure and unauthorized command execution.
You can check your version of Emacs by running 'emacs --version' in the terminal. If it is below 1:27.2-18.el9_8.2, it is affected.
If an immediate update is not possible, consider disabling the vulnerable features or using alternative methods for file access until the patch is applied.
More information can be found on the CVE pages for CVE-2026-77219 and CVE-2026-79992, which provide detailed insights into the vulnerabilities.
Vulert monitors and alerts for open-source vulnerabilities in your software using a manifest file like package-lock.json, allowing you to stay informed about potential risks.
Related vulnerabilities
Recent vulnerabilities recorded for emacs.
