Re: Emacs arbitrary code execution: incomplete fix for CVE-2024-53920
CVE-2026-96442 was assigned for an incomplete Emacs fix of arbitrary code execution CVE-2024-53920.
47
Vulnerability2 · 1 read
CVE-2026-96442
Arbitrary Code Execution via Flymake in GNU Emacs
- CVSS 3.1
- 7.8 high
- EPSS
- —
- Published
- ·
- Modified
AI analysisSummaries by Vani AI
A code execution vulnerability exists in GNU Emacs versions prior to 31.2. The flaw is triggered when the Flymake mode performs syntax checking using a language backend other than Lisp, causing it to execute arbitrary code from the currently open file. This allows an attacker to achieve arbitrary code execution with the privileges of the user running Emacs by luring them into viewing or editing a malicious file. No public proof-of-concept or exploitation in the wild has been reported at this time. The vulnerability is rated as high severity.
What to do: Upgrade to Emacs version 31.2 or later immediately. If upgrading is not immediately possible, disable Flymake mode or ensure you only open trusted files.
| Product | Affected |
|---|---|
| GNU Emacs | prior to 31.2 |
Estimated exposure
No basis for an estimate.
Order-of-magnitude estimate by the model from install counts, market share and public scan data it knows; verify before quoting.
Description · NVD
A code execution flaw was found in Emacs, affecting versions prior to 31.2. The Flymake mode using language backends other than Lisp would execute arbitrary code from the edited file while performing syntax checking. Viewing or editing untrusted files using Emacs could lead to arbitrary code execution with the privileges of the user running Emacs.
- Weakness
- CWE-94
- Vector
- CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H