Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
Emacs < 29.4-7 may execute code on opening files
published 1 month ago
Summary
Versions of Emacs from 28.1 up to 31.1 can run arbitrary code when a specially crafted file is opened, even with the default settings. This could let an attacker take control of the system that runs Emacs. Upgrade to Emacs 29.4-7 or later, or apply the vendor's security patch, and avoid opening files from untrusted sources.
What to do
- Update emacs to version 29.4-7.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| Azure Linux:3 | – | emacs |
< 29.4-7 Fix: upgrade to 29.4-7
|
| Azure Linux:3 | azure | emacs | <= 29.4-6 |
Original advisory text
CVE-2026-96269 affecting package emacs for versions less than 29.4-7
GNU Emacs 28.1 through 31.1 allows arbitrary code execution upon opening a file, because an untrusted value of read-symbol-shorthands affects the intern and unintern functions. This affects the default configuration; no particular user settings are required to trigger it.
References
Timeline
Published22 Sep 2026
Updated2 Nov 2026
First seen30 Sep 2026
Sources
AZL-103410 · OSV
Track software like this
Free during beta