Re: GNU Emacs vulnerability upon opening arbitrary file
CVE-2026-96269 was assigned to a GNU Emacs flaw triggered by opening an arbitrary file.
A short oss-security follow-up says CVE-2026-96269 was assigned on September 22, 2026, to a previously discussed GNU Emacs issue. The vulnerability is triggered when Emacs opens an arbitrary file. The message includes no affected versions, impact details, exploit information, or patch guidance.
- CVE-2026-96269 was assigned the day before the September 23 post.
- The flaw affects GNU Emacs when it opens an arbitrary file.
- The message gives no versions, impact details, or patch information.
Vulnerabilities mentionedAll →
- CVE-2026-962697.5—Arbitrary Code Execution via read-symbol-shorthands in GNU Emacs 28.1–31.1published · GNU Project (Free Software Foundation) Emacs
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2026-96269 | Arbitrary Code Execution via read-symbol-shorthands in GNU Emacs 28.1–31.1 GNU Emacs 28.1 through 31.1 can execute arbitrary code merely when a user opens a specially crafted file, because an untrusted, file-supplied value of read-symbol-shorthands is mishandled by the intern and unintern functions (CWE-829, inclusion of functionality from an untrusted control sphere). The flaw triggers in the stock default configuration — no special user settings are required — so any user who opens an attacker-supplied file (via email, download, or a cloned repository) can have attacker-controlled Elisp run as their own account. Impact is confined to the local user's account (CVSS 4.0 7.5, local attack vector), but it is a realistic code-execution vector for developers who routinely open files from untrusted sources. There is no known public proof of concept, no indication of exploitation in the wild, and the CVE is not on CISA's KEV list. |
Posted by Tomas Hoger on Sep 23 CVE-2026-96269 was assigned to this issue yesterday.
This source does not provide full text. Read it at seclists.org.