Arbitrary Code Execution via read-symbol-shorthands in GNU Emacs 28.1–31.1
GNU Emacs 28.1 through 31.1 can execute arbitrary code merely when a user opens a specially crafted file, because an untrusted, file-supplied value of read-symbol-shorthands is mishandled by the intern and unintern functions (CWE-829, inclusion of functionality from an untrusted control sphere). The flaw triggers in the stock default configuration — no special user settings are required — so any user who opens an attacker-supplied file (via email, download, or a cloned repository) can have attacker-controlled Elisp run as their own account. Impact is confined to the local user's account (CVSS 4.0 7.5, local attack vector), but it is a realistic code-execution vector for developers who routinely open files from untrusted sources. There is no known public proof of concept, no indication of exploitation in the wild, and the CVE is not on CISA's KEV list.
What to do: Upgrade to an Emacs release newer than 31.1 (or your distribution's patched package) as soon as it is available. Until then, avoid opening files from untrusted or unknown sources, and consider setting enable-local-variables to nil (and enable-local-eval to nil) to block file-local settings such as read-symbol-shorthands. Review any recently opened files of unknown origin for signs of tampering or unexpected Elisp.
| GNU Project (Free Software Foundation) Emacs | 28.1 through 31.1 |
Order-of-magnitude estimate by the model from install counts, market share and public scan data it knows; verify before quoting.
GNU Emacs 28.1 through 31.1 allows arbitrary code execution upon opening a file, because an untrusted value of read-symbol-shorthands affects the intern and unintern functions. This affects the default configuration; no particular user settings are required to trigger it.
CVE-2026-96269 was assigned to a GNU Emacs flaw triggered by opening an arbitrary file.
A short oss-security follow-up says CVE-2026-96269 was assigned on September 22, 2026, to a previously discussed GNU Emacs issue. The vulnerability is triggered when Emacs opens an arbitrary file. The message includes no affected versions, impact details, exploit information, or patch guidance.