Critical Security Flaws in GNU Emacs: Heap Over-read, Command Injection, and Code Execution Vulnerabilities
Summary
RLSA-2026:84591: Important: emacs security update. Affects emacs versions < 1:29.4-14.el10_2.3. Fixed in 1:29.4-14.el10_2.3. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
GNU Emacs is a powerful, customizable, self-documenting text editor widely used for programming and text editing. It features advanced code editing capabilities, a built-in scripting language (elisp), and the ability to manage emails and news. However, recent vulnerabilities have been identified that could compromise the security of systems running Emacs, making it crucial for users to stay informed and take action.
Vulnerability Detail
The vulnerabilities in GNU Emacs include a heap over-read that can lead to information disclosure via crafted images (CVE-2026-77219), command injection through specially crafted filenames in TRAMP (CVE-2026-79992), and arbitrary code execution in Flymake mode (CVE-2026-96442). These flaws can potentially allow attackers to gain unauthorized access to sensitive information or execute malicious code, posing significant risks to users and systems.
How To Fix
Minimum fixed version
1:29.4-14.el10_2.3
This is the first release that contains the fix.
sudo dnf update emacsTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary measure, users can avoid opening untrusted images or files with crafted filenames in TRAMP until the package is updated. This can help mitigate the risk of exploitation until a proper fix is applied.
Conclusion
The identified vulnerabilities in GNU Emacs pose significant risks to users, including potential information disclosure and arbitrary code execution. It is essential to update to the latest patched version to safeguard against these threats. Users are encouraged to remain vigilant and utilize tools like Vulert to monitor for vulnerabilities in their applications.
See every vulnerability recorded for emacs →
FAQ
GNU Emacs is a versatile text editor that supports various programming languages and offers extensive customization options.
The main vulnerabilities include heap over-read, command injection via TRAMP, and arbitrary code execution in Flymake mode.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in your software. Visit Vulert Scanner to check your application without signing up.
If an update is not possible, avoid opening untrusted files or images until the vulnerabilities are patched.
The CVSS score for these vulnerabilities is 7.8, indicating a high level of severity.
References
Related vulnerabilities
Recent vulnerabilities recorded for emacs.
