Critical Security Update for GNU Emacs: Heap Over-read and Shell Command Injection Vulnerabilities
Summary
ALSA-2026:80506: Important: emacs security update. Affects emacs versions < 1:26.1-15.el8_10.2. Fixed in 1:26.1-15.el8_10.2. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
GNU Emacs is a powerful, customizable, self-documenting text editor widely used for programming and text editing. It features advanced code editing capabilities, a built-in scripting language (elisp), and the ability to manage emails and news. However, recent vulnerabilities have been identified that could compromise user data and system security.
Vulnerability Detail
The vulnerabilities in GNU Emacs include a heap over-read that can lead to information disclosure via crafted images (CVE-2026-77219) and local shell command injection through the user field in Emacs TRAMP (CVE-2026-79992). These vulnerabilities arise from improper handling of user input and memory management, potentially allowing attackers to exploit these weaknesses to gain unauthorized access to sensitive information or execute arbitrary commands.
How To Fix
Minimum fixed version
1:26.1-15.el8_10.2
This is the first release that contains the fix.
sudo dnf update emacsTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary measure, users can avoid opening untrusted images or executing unverified shell commands within Emacs until the update is applied. This can help mitigate the risk of exploitation until the vulnerability is fully resolved.
Conclusion
The identified vulnerabilities in GNU Emacs pose significant risks to user data and system security. It is crucial for users to update their packages to the latest patched version to mitigate these risks. Additionally, employing workarounds can provide temporary relief until the update is applied.
See every vulnerability recorded for emacs →
FAQ
The vulnerabilities include a heap over-read that can lead to information disclosure and local shell command injection, which can allow unauthorized command execution.
You can check your Emacs version by running 'emacs --version' in the terminal. If it is below 1:26.1-15.el8_10.2, it is affected.
As a workaround, avoid opening untrusted images or executing shell commands in Emacs until you can apply the update.
Detailed information can be found on the CVE pages for CVE-2026-77219 and CVE-2026-79992.
Vulert monitors and alerts for open-source vulnerabilities in your software using just a manifest file like package-lock.json, allowing you to stay informed without needing to access the code.
Related vulnerabilities
Recent vulnerabilities recorded for emacs.
