Incomplete fix for Emacs CVE-2026-79992
Researchers found Emacs CVE-2026-79992's fix incomplete because TRAMP still accepts dangerous username characters.
Wonyoung Jung of 78ResearchLab, using the PatchHawk tool, reported that the fix for CVE-2026-79992 in GNU Emacs was incomplete. The tramp-user-regexp still failed to reject some problematic characters in user names, so exploitation remained possible. TRAMP maintainer Michael Albinus supplied a patch that will ship in Emacs 31.2, which is not expected soon.
- 78ResearchLab's PatchHawk found the CVE-2026-79992 fix incomplete.
- tramp-user-regexp still misses some dangerous characters in usernames.
- Michael Albinus's patch is planned for Emacs 31.2, not soon.
- Exploitation remained possible after the earlier fix.
- CVEs
- CVE-2026-79992
- Vendors
- GNU
- Organizations
- 78ResearchLab
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-79992 | Shell argument injection in GNU Emacs TRAMP (incomplete fix of CVE-2024-53920) | 7.8 | <1% |
From the original article
Posted by Sean Whitton on Oct 11 Wonyoung Jung of 78ResearchLab, using their PatchHawk tool, discovered that the fix for CVE-2026-79992 was incomplete. The tramp-user-regexp failed to check for some additional problematic characters in user names, meaning that exploitation was still possible. The attached patch by TRAMP maintainer Michael Albinus addresses the problem.
seclists.org
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.