CVE-2026-96269

GNU Emacs 28.1 through 31.1 can execute arbitrary code merely when a user opens a specially crafted file, because an untrusted, file-supplied value of read-symbol-shorthands is mishandled by the intern and unintern functions (CWE-829, inclusion of functionality from an untrusted control sphere). The flaw triggers in the stock default configuration — no special user settings are required — so any user who opens an attacker-supplied file (via email, download, or a cloned repository) can have attacker-controlled Elisp run as their own account. Impact is confined to the local user's account (CVSS 4.0 7.5, local attack vector), but it is a realistic code-execution vector for developers who routinely open files from untrusted sources. There is no known public proof of concept, no indication of exploitation in the wild, and the CVE is not on CISA's KEV list.

What to do: Upgrade to an Emacs release newer than 31.1 (or your distribution's patched package) as soon as it is available. Until then, avoid opening files from untrusted or unknown sources, and consider setting enable-local-variables to nil (and enable-local-eval to nil) to block file-local settings such as read-symbol-shorthands. Review any recently opened files of unknown origin for signs of tampering or unexpected Elisp.