Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
AlmaLinux Emacs could leak data or run commands
published 24 days ago
Summary
The Emacs text editor packages supplied by AlmaLinux can be tricked by a specially crafted image file to reveal information stored in memory. A feature that lets Emacs access remote files can also be used to cause the program to run commands on the system. Install the latest Emacs update from AlmaLinux and restart any running Emacs sessions to stay safe.
What to do
- Update almalinux emacs to version 1:26.1-15.el8_10.2.
- Update almalinux emacs-common to version 1:26.1-15.el8_10.2.
- Update almalinux emacs-filesystem to version 1:26.1-15.el8_10.2.
- Update almalinux emacs-lucid to version 1:26.1-15.el8_10.2.
- Update almalinux emacs-nox to version 1:26.1-15.el8_10.2.
- Update almalinux emacs-terminal to version 1:26.1-15.el8_10.2.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| AlmaLinux:8 | almalinux | emacs |
< 1:26.1-15.el8_10.2 Fix: upgrade to 1:26.1-15.el8_10.2
|
| AlmaLinux:8 | almalinux | emacs-common |
< 1:26.1-15.el8_10.2 Fix: upgrade to 1:26.1-15.el8_10.2
|
| AlmaLinux:8 | almalinux | emacs-filesystem |
< 1:26.1-15.el8_10.2 Fix: upgrade to 1:26.1-15.el8_10.2
|
| AlmaLinux:8 | almalinux | emacs-lucid |
< 1:26.1-15.el8_10.2 Fix: upgrade to 1:26.1-15.el8_10.2
|
| AlmaLinux:8 | almalinux | emacs-nox |
< 1:26.1-15.el8_10.2 Fix: upgrade to 1:26.1-15.el8_10.2
|
| AlmaLinux:8 | almalinux | emacs-terminal |
< 1:26.1-15.el8_10.2 Fix: upgrade to 1:26.1-15.el8_10.2
|
Original advisory text
Important: emacs security update
GNU Emacs is a powerful, customizable, self-documenting text editor. It provides special code editing features, a scripting language (elisp), and the capability to read e-mail and news.
Security Fix(es):
* emacs: GNU Emacs: Heap over-read leading to information disclosure via crafted image (CVE-2026-77219)
* emacs: local shell command injection through the user field in emacs tramp (CVE-2026-79992)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Security Fix(es):
* emacs: GNU Emacs: Heap over-read leading to information disclosure via crafted image (CVE-2026-77219)
* emacs: local shell command injection through the user field in emacs tramp (CVE-2026-79992)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
References
- https://access.redhat.com/errata/RHSA-2026:80506 Vendor Advisory
- https://access.redhat.com/security/cve/CVE-2026-77219 Third Party Advisory
- https://access.redhat.com/security/cve/CVE-2026-79992 Third Party Advisory
- https://bugzilla.redhat.com/2521196 Third Party Advisory
- https://bugzilla.redhat.com/2523665 Third Party Advisory
- https://errata.almalinux.org/8/ALSA-2026-80506.html Vendor Advisory
Timeline
Published12 Oct 2026
Updated13 Oct 2026
First seen13 Oct 2026
Sources
ALSA-2026:80506 · OSV
Track software like this
Free during beta