Skip to content
NewA calmer, faster ZeroHour
StoryVulnerabilityhigh

Two new GNU Emacs CVEs assigned on oss-security

1 source · 2 articlesFirst reported Updated ()1 · 1 read
What's new

First coverage.

Merged summary · grok-4.7 · rewritten as coverage arrivesSummaries by Vani AI

Oss-security assigned CVE-2026-96442 to an incomplete Emacs fix and CVE-2026-96269 to a file-open flaw.

Two September 23, 2026 oss-security follow-ups assign new identifiers to previously discussed GNU Emacs issues, without saying the flaws are the same. Tomas Hoger's note says CVE-2026-96442 covers an incomplete fix for arbitrary code execution vulnerability CVE-2024-53920. A second note says CVE-2026-96269 was assigned on September 22, 2026, to a GNU Emacs vulnerability triggered by opening an arbitrary file. Neither message lists affected versions, a patch, exploit details, or evidence of in-the-wild use, and the second also omits impact details. The sources do not contradict each other; they simply describe distinct CVE assignments with limited technical detail.

Key facts
  • On September 23, 2026, Tomas Hoger's oss-security note said CVE-2026-96442 was assigned for an Emacs arbitrary code execution issue.
  • CVE-2026-96442 is described as an incomplete fix for earlier vulnerability CVE-2024-53920.
  • That note gives no affected versions, patch, exploit details, or evidence of in-the-wild use.
  • A separate September 23, 2026 oss-security follow-up says CVE-2026-96269 was assigned on September 22, 2026, to a previously discussed GNU Emacs issue.
  • CVE-2026-96269 is triggered when Emacs opens an arbitrary file; the message gives no versions, impact details, exploit information, or patch guidance.
  • The two posts do not state that CVE-2026-96442 and CVE-2026-96269 are the same flaw.
Analyze CVE-2026-96442 with Vani AIImpact, affected versions, exploitation, mitigations and detection
CVEs
CVE-2026-96442CVE-2024-53920CVE-2026-96269
Vendors
GNU
Products
GNU Emacs
Organizations
GNU

Coverage

oldest first · one row per article · UTC
  1. · Sep 23, 2026 oss-securityFirst report

    Re: Emacs arbitrary code execution: incomplete fix for CVE-2024-53920

    CVE-2026-96442 was assigned for an incomplete Emacs fix of arbitrary code execution CVE-2024-53920.

  2. · Sep 23, 2026 oss-security

    Re: GNU Emacs vulnerability upon opening arbitrary file

    CVE-2026-96269 was assigned to a GNU Emacs flaw triggered by opening an arbitrary file.

Vulnerabilities in this story

All
CVEVulnerabilityCVSSEPSSSignalsPublished
CVE-2024-53920
In elisp-mode.el in GNU Emacs before 30.1, a user who chooses to invoke elisp-completion-at-point (for code completion) on untrusted Emacs Lisp source code can…
7.8<1%
CVE-2026-96269
Arbitrary Code Execution via read-symbol-shorthands in GNU Emacs 28.1–31.1
7.5—
CVE-2026-96442
Arbitrary Code Execution via Flymake in GNU Emacs
7.8—