Every CVE Search/ Get API key

CVE-2026-77219

GNU Emacs < 31.0.91 Heap Over-Read via PBM/PPM/PGM Image Loader

6.9 MediumFix available

GNU Emacs before 31.0.91 contains an integer overflow in the PBM/PPM/PGM image loader that allows an attacker to leak heap memory contents by supplying a crafted image with large dimensions and an elevated max color index. The image loader multiplies image dimensions and channel count using signed integer arithmetic; for sufficiently large values, the result wraps to a negative number, bypassing the bounds check and causing the pixel reader to access heap memory past the end of the allocated buffer. The over-read contents are interpreted as pixel color values and rendered on screen.

Attack profile

How easy it is to exploit

Attack vector
Local
Complexity
Low
Privileges needed
None
User interaction
Passive

What an attacker can affect

Confidentiality
High
Integrity
None
Availability
High

Exploit likelihood

0.13%Unchanged since Aug 22, 2026
90%50%10%1%

What each source reports

CVE List Score used 6.9

GNU Emacs < 31.0.91 Heap Over-Read via PBM/PPM/PGM Image Loader

GNU Emacs before 31.0.91 contains an integer overflow in the PBM/PPM/PGM image loader that allows an attacker to leak heap memory contents by supplying a crafted image with large dimensions and an elevated max color index. The image loader multiplies image dimensions and channel count using signed integer arithmetic; for sufficiently large values, the result wraps to a negative number, bypassing the bounds check and causing the pixel reader to access heap memory past the end of the allocated buffer. The over-read contents are interpreted as pixel color values and rendered on screen.

Record
CVE-2026-77219
CVSS 4.0
6.9 MediumCVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:N/VA:H/SC:N/SI:N/SA:N
CVSS 3.1
7.1 HighCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:H
Weakness
CWE-190, CWE-125
Updated
2026-11-02
EUVDEUVD-2026-64138 6.9

GNU Emacs before 31.0.91 contains an integer overflow in the PBM/PPM/PGM image loader that allows an attacker to leak heap memory contents by supplying a crafted image with large dimensions and an elevated max color index. The image loader multiplies image dimensions and channel count using signed integer arithmetic; for sufficiently large values, the result wraps to a negative number, bypassing the bounds check and causing the pixel reader to access heap memory past the end of the allocated buffer. The over-read contents are interpreted as pixel color values and rendered on screen.

Record
EUVD-2026-64138
CVSS 4.0
6.9 MediumCVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:N/VA:H/SC:N/SI:N/SA:N
Updated
2026-11-02
GitHub AdvisoriesGHSA-q8pr-2495-3jw7 6.9

GNU Emacs before 31.0.91 contains an integer overflow in the PBM/PPM/PGM image loader that allows...

GNU Emacs before 31.0.91 contains an integer overflow in the PBM/PPM/PGM image loader that allows an attacker to leak heap memory contents by supplying a crafted image with large dimensions and an elevated max color index. The image loader multiplies image dimensions and channel count using signed integer arithmetic; for sufficiently large values, the result wraps to a negative number, bypassing the bounds check and causing the pixel reader to access heap memory past the end of the allocated buffer. The over-read contents are interpreted as pixel color values and rendered on screen.

Record
GHSA-q8pr-2495-3jw7
CVSS 4.0
6.9 MediumCVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
CVSS 3.1
7.1 HighCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:H
Weakness
CWE-125
Updated
2026-11-02
NVD 6.9

GNU Emacs before 31.0.91 contains an integer overflow in the PBM/PPM/PGM image loader that allows an attacker to leak heap memory contents by supplying a crafted image with large dimensions and an elevated max color index. The image loader multiplies image dimensions and channel count using signed integer arithmetic; for sufficiently large values, the result wraps to a negative number, bypassing the bounds check and causing the pixel reader to access heap memory past the end of the allocated buffer. The over-read contents are interpreted as pixel color values and rendered on screen.

Record
CVE-2026-77219
CVSS 4.0
6.9 MediumCVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
CVSS 3.1
7.1 HighCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:H
Weakness
CWE-125, CWE-190
Updated
2026-11-02
OSV 6.9

GNU Emacs < 31.0.91 Heap Over-Read via PBM/PPM/PGM Image Loader

GNU Emacs before 31.0.91 contains an integer overflow in the PBM/PPM/PGM image loader that allows an attacker to leak heap memory contents by supplying a crafted image with large dimensions and an elevated max color index. The image loader multiplies image dimensions and channel count using signed integer arithmetic; for sufficiently large values, the result wraps to a negative number, bypassing the bounds check and causing the pixel reader to access heap memory past the end of the allocated buffer. The over-read contents are interpreted as pixel color values and rendered on screen.

Record
CVE-2026-77219
CVSS 4.0
6.9 MediumCVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:N/VA:H/SC:N/SI:N/SA:N
Weakness
CWE-125, CWE-190
Updated
2026-11-02
OSVDEBIAN-CVE-2026-77219 6.9

GNU Emacs before 31.0.91 contains an integer overflow in the PBM/PPM/PGM image loader that allows an attacker to leak heap memory contents by supplying a crafted image with large dimensions and an elevated max color index. The image loader multiplies image dimensions and channel count using signed integer arithmetic; for sufficiently large values, the result wraps to a negative number, bypassing the bounds check and causing the pixel reader to access heap memory past the end of the allocated buffer. The over-read contents are interpreted as pixel color values and rendered on screen.

Record
DEBIAN-CVE-2026-77219
CVSS 4.0
6.9 MediumCVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Updated
2026-11-02
Show 17 moreShow less
OSVOESA-2026-4083 6.9

emacs security update

Emacs is the extensible, customizable, self-documenting real-time display editor. At its core is an interpreter for Emacs Lisp, a dialect of the Lisp programming language with extensions to support text editing. And it is an entire ecosystem of functionality beyond text editing, including a project planner, mail and news reader, debugger interface, calendar, and more.

Security Fix(es):

GNU Emacs before 31.0.91 contains an integer overflow in the PBM/PPM/PGM image loader that allows an attacker to leak heap memory contents by supplying a crafted image with large dimensions and an elevated max color index. The image loader multiplies image dimensions and channel count using signed integer arithmetic; for sufficiently large values, the result wraps to a negative number, bypassing the bounds check and causing the pixel reader to access heap memory past the end of the allocated buffer. The over-read contents are interpreted as pixel color values and rendered on screen.(CVE-2026-77219)

Record
OESA-2026-4083
CVSS 4.0
6.9 MediumCVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:N/VA:H/SC:N/SI:N/SA:N
Updated
2026-11-02
OSVRHSA-2026:80506 7.8

Red Hat Security Advisory: emacs security update

Record
RHSA-2026:80506
CVSS 3.1
7.8 HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVRHSA-2026:80507 7.8

Red Hat Security Advisory: emacs security update

Record
RHSA-2026:80507
CVSS 3.1
7.8 HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVRHSA-2026:84591 7.8

Red Hat Security Advisory: emacs security update

Record
RHSA-2026:84591
CVSS 3.1
7.8 HighCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVRLSA-2026:80506 7.8

Important: emacs security update

GNU Emacs is a powerful, customizable, self-documenting text editor. It provides special code editing features, a scripting language (elisp), and the capability to read e-mail and news.

Security Fix(es):

  • emacs: GNU Emacs: Heap over-read leading to information disclosure via crafted image (CVE-2026-77219)

  • emacs: local shell command injection through the user field in emacs tramp (CVE-2026-79992)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record
RLSA-2026:80506
CVSS 3.1
7.8 HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVRLSA-2026:80507 7.8

Important: emacs security update

GNU Emacs is a powerful, customizable, self-documenting text editor. It provides special code editing features, a scripting language (elisp), and the capability to read e-mail and news.

Security Fix(es):

  • emacs: GNU Emacs: Heap over-read leading to information disclosure via crafted image (CVE-2026-77219)

  • emacs: local shell command injection through the user field in emacs tramp (CVE-2026-79992)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record
RLSA-2026:80507
CVSS 3.1
7.8 HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVRLSA-2026:84591 7.8

Important: emacs security update

GNU Emacs is a powerful, customizable, self-documenting text editor. It provides special code editing features, a scripting language (elisp), and the capability to read e-mail and news.

Security Fix(es):

  • emacs: GNU Emacs: Heap over-read leading to information disclosure via crafted image (CVE-2026-77219)

  • emacs: emacs: Command injection via crafted filenames in TRAMP (CVE-2026-79992)

  • emacs: Emacs: arbitrary code execution in Flymake mode (CVE-2026-96442)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record
RLSA-2026:84591
CVSS 3.1
7.8 HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVUBUNTU-CVE-2026-77219 6.9

GNU Emacs before 31.0.91 contains an integer overflow in the PBM/PPM/PGM image loader that allows an attacker to leak heap memory contents by supplying a crafted image with large dimensions and an elevated max color index. The image loader multiplies image dimensions and channel count using signed integer arithmetic; for sufficiently large values, the result wraps to a negative number, bypassing the bounds check and causing the pixel reader to access heap memory past the end of the allocated buffer. The over-read contents are interpreted as pixel color values and rendered on screen.

Record
UBUNTU-CVE-2026-77219
CVSS 4.0
6.9 MediumCVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:N/VA:H/SC:N/SI:N/SA:N
CVSS 3.1
7.1 HighCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:H
Updated
2026-11-02
OSVALSA-2026:80506 No score

Important: emacs security update

GNU Emacs is a powerful, customizable, self-documenting text editor. It provides special code editing features, a scripting language (elisp), and the capability to read e-mail and news.

Security Fix(es):

  • emacs: GNU Emacs: Heap over-read leading to information disclosure via crafted image (CVE-2026-77219)
  • emacs: local shell command injection through the user field in emacs tramp (CVE-2026-79992)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record
ALSA-2026:80506
Updated
2026-11-02
OSVALSA-2026:80507 No score

Important: emacs security update

GNU Emacs is a powerful, customizable, self-documenting text editor. It provides special code editing features, a scripting language (elisp), and the capability to read e-mail and news.

Security Fix(es):

  • emacs: GNU Emacs: Heap over-read leading to information disclosure via crafted image (CVE-2026-77219)
  • emacs: local shell command injection through the user field in emacs tramp (CVE-2026-79992)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record
ALSA-2026:80507
Updated
2026-11-02
OSVALSA-2026:84591 No score

Important: emacs security update

GNU Emacs is a powerful, customizable, self-documenting text editor. It provides special code editing features, a scripting language (elisp), and the capability to read e-mail and news.

Security Fix(es):

  • emacs: GNU Emacs: Heap over-read leading to information disclosure via crafted image (CVE-2026-77219)
  • emacs: emacs: Command injection via crafted filenames in TRAMP (CVE-2026-79992)
  • emacs: Emacs: arbitrary code execution in Flymake mode (CVE-2026-96442)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record
ALSA-2026:84591
Updated
2026-11-02
OSVAZL-96986 No score

CVE-2026-77219 affecting package emacs for versions less than 29.4-6

GNU Emacs before 31.0.91 contains an integer overflow in the PBM/PPM/PGM image loader that allows an attacker to leak heap memory contents by supplying a crafted image with large dimensions and an elevated max color index. The image loader multiplies image dimensions and channel count using signed integer arithmetic; for sufficiently large values, the result wraps to a negative number, bypassing the bounds check and causing the pixel reader to access heap memory past the end of the allocated buffer. The over-read contents are interpreted as pixel color values and rendered on screen.

Record
AZL-96986
Updated
2026-11-02
OSVCLSA-2026-1792080478 No score

emacs: Fix of 3 CVEs

  • CVE-2026-77219: fix integer overflow in PBM image loader
  • CVE-2026-79992: restrict Tramp user names to prevent shell command injection
  • CVE-2026-108976: strengthen Tramp user and host name validation
Record
CLSA-2026-1792080478
Updated
2026-11-02
OSVopenSUSE-SU-2026:21711-1 No score

Security update for emacs

This update for emacs fixes the following issues:

Security issues fixed:

  • Arbitrary code execution when opening a specially crafted file (bsc#1275941).
  • CVE-2026-77219: integer overflow in the PBM/PPM/PGM image loader leads to heap memory content leaks when a crafted image with large dimensions and an elevated max color index is processed (bsc#1276264).
  • CVE-2026-79992: improper argument sanitization in TRAMP leads to arbitrary code execution via crafted filenames (bsc#1275927).

Other updates and bugfixes:

  • Fix memory leak in wayland port (bsc#1271643).
Record
openSUSE-SU-2026:21711-1
Updated
2026-11-02
OSVSUSE-SU-2026:23589-1 No score

Security update for emacs

This update for emacs fixes the following issues:

Security issues fixed:

  • Arbitrary code execution when opening a specially crafted file (bsc#1275941).
  • CVE-2026-77219: integer overflow in the PBM/PPM/PGM image loader leads to heap memory content leaks when a crafted image with large dimensions and an elevated max color index is processed (bsc#1276264).
  • CVE-2026-79992: improper argument sanitization in TRAMP leads to arbitrary code execution via crafted filenames (bsc#1275927).

Other updates and bugfixes:

  • Fix memory leak in wayland port (bsc#1271643).
Record
SUSE-SU-2026:23589-1
Updated
2026-11-02
OSVSUSE-SU-2026:3993-1 No score

Security update for emacs

This update for emacs fixes the following issues:

  • code execution upon opening arbitrary file (bsc#1275941).
  • CVE-2026-77219: memory leak via the PBM/PPM/PGM image loader (bsc#1276264).
  • CVE-2026-79992: zero-click local command execution via TRAMP (bsc#1275927).
Record
SUSE-SU-2026:3993-1
Updated
2026-11-02
OSVSUSE-SU-2026:4083-1 No score

Security update for emacs

This update for emacs fixes the following issues:

  • Arbitrary code execution when opening a specially crafted file (bsc#1275941).
  • CVE-2026-77219: integer overflow in the PBM/PPM/PGM image loader leads to heap memory content leaks when a crafted image with large dimensions and an elevated max color index is processed (bsc#1276264).
  • CVE-2026-79992: improper argument sanitization in TRAMP leads to arbitrary code execution via crafted filenames (bsc#1275927).
Record
SUSE-SU-2026:4083-1
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
emacs
AlmaLinux:8
 before 1:26.1-15.el8_10.2
1:26.1-15.el8_10.2
emacs-common
AlmaLinux:8
 before 1:26.1-15.el8_10.2
1:26.1-15.el8_10.2
emacs-filesystem
AlmaLinux:8
 before 1:26.1-15.el8_10.2
1:26.1-15.el8_10.2
emacs-lucid
AlmaLinux:8
 before 1:26.1-15.el8_10.2
1:26.1-15.el8_10.2
emacs-nox
AlmaLinux:8
 before 1:26.1-15.el8_10.2
1:26.1-15.el8_10.2
emacs-terminal
AlmaLinux:8
 before 1:26.1-15.el8_10.2
1:26.1-15.el8_10.2
emacs
AlmaLinux:9
 before 1:27.2-18.el9_8.2
1:27.2-18.el9_8.2
emacs-common
AlmaLinux:9
 before 1:27.2-18.el9_8.2
1:27.2-18.el9_8.2
emacs-filesystem
AlmaLinux:9
 before 1:27.2-18.el9_8.2
1:27.2-18.el9_8.2
emacs-lucid
AlmaLinux:9
 before 1:27.2-18.el9_8.2
1:27.2-18.el9_8.2
Show 96 moreShow less
Affected packages
PackageAffectedFixed
emacs-nox
AlmaLinux:9
 before 1:27.2-18.el9_8.2
1:27.2-18.el9_8.2
emacs
AlmaLinux:10
 before 1:29.4-14.el10_2.3
1:29.4-14.el10_2.3
emacs-common
AlmaLinux:10
 before 1:29.4-14.el10_2.3
1:29.4-14.el10_2.3
emacs-filesystem
AlmaLinux:10
 before 1:29.4-14.el10_2.3
1:29.4-14.el10_2.3
emacs-lucid
AlmaLinux:10
 before 1:29.4-14.el10_2.3
1:29.4-14.el10_2.3
emacs-nw
AlmaLinux:10
 before 1:29.4-14.el10_2.3
1:29.4-14.el10_2.3
emacs
Azure Linux:3
 before 29.4-6
29.4-6
emacs
TuxCare:AlmaLinux:9.2
 before 1:27.2-8.el9_2.1.tuxcare.els7
1:27.2-8.el9_2.1.tuxcare.els7
emacs-common
TuxCare:AlmaLinux:9.2
 before 1:27.2-8.el9_2.1.tuxcare.els7
1:27.2-8.el9_2.1.tuxcare.els7
emacs-devel
TuxCare:AlmaLinux:9.2
 before 1:27.2-8.el9_2.1.tuxcare.els7
1:27.2-8.el9_2.1.tuxcare.els7
emacs-filesystem
TuxCare:AlmaLinux:9.2
 before 1:27.2-8.el9_2.1.tuxcare.els7
1:27.2-8.el9_2.1.tuxcare.els7
emacs-lucid
TuxCare:AlmaLinux:9.2
 before 1:27.2-8.el9_2.1.tuxcare.els7
1:27.2-8.el9_2.1.tuxcare.els7
emacs-nox
TuxCare:AlmaLinux:9.2
 before 1:27.2-8.el9_2.1.tuxcare.els7
1:27.2-8.el9_2.1.tuxcare.els7
emacs-terminal
TuxCare:AlmaLinux:9.2
 before 1:27.2-8.el9_2.1.tuxcare.els7
1:27.2-8.el9_2.1.tuxcare.els7
emacs
Debian:12
 All versions, plus listed versions
1:28.2+1-151:28.2+1-15+deb12u11:28.2+1-15+deb12u21:28.2+1-15+deb12u31:28.2+1-15+deb12u4
Show 45 moreShow less
1:28.2+1-161:29.1+1-11:29.1+1-21:29.1+1-31:29.1+1-41:29.1+1-51:29.1+1-5~bpo12+11:29.2+1-11:29.2+1-21:29.2+1-2~bpo12+11:29.3+1-11:29.3+1-21:29.3+1-2~bpo12+11:29.3+1-31:29.3+1-3~bpo12+11:29.4+1-11:29.4+1-21:29.4+1-2~bpo12+11:29.4+1-31:29.4+1-41:29.4+1-4~bpo12+11:29.4+1-51:29.4+1-61:29.4+1-6+alpha1:30.1+1-11:30.1+1-21:30.1+1-31:30.1+1-3~bpo12+11:30.1+1-41:30.1+1-4~bpo12+11:30.1+1-51:30.1+1-5~bpo12+11:30.1+1-61:30.1+1-6~bpo12+11:30.1+1-71:30.1+1-81:30.1+1-91:30.2+1-11:30.2+1-101:30.2+1-111:30.2+1-21:30.2+1-31:30.2+1-41:30.2+1-51:30.2+1-6
 None known
emacs
Debian:13
 All versions, plus listed versions
1:30.1+1-61:30.1+1-6+deb13u11:30.1+1-71:30.1+1-81:30.1+1-9
Show 11 moreShow less
1:30.2+1-11:30.2+1-101:30.2+1-111:30.2+1-21:30.2+1-31:30.2+1-41:30.2+1-51:30.2+1-61:30.2+1-71:30.2+1-81:30.2+1-9
 None known
emacs
Debian:14
 All versions, plus listed versions
1:30.1+1-61:30.1+1-71:30.1+1-81:30.1+1-91:30.2+1-1
Show 10 moreShow less
1:30.2+1-101:30.2+1-111:30.2+1-21:30.2+1-31:30.2+1-41:30.2+1-51:30.2+1-61:30.2+1-71:30.2+1-81:30.2+1-9
 None known
emacs
openEuler:22.03-LTS-SP4
 before 27.2-19.oe2203sp4
27.2-19.oe2203sp4
emacs
openEuler:24.03-LTS-SP1
 before 29.1-9.oe2403sp1
29.1-9.oe2403sp1
emacs
openEuler:24.03-LTS-SP3
 before 29.1-9.oe2403sp3
29.1-9.oe2403sp3
emacs
openEuler:24.03-LTS-SP4
 before 29.1-10.oe2403sp4
29.1-10.oe2403sp4
emacs
openEuler:20.03-LTS-SP4
 before 27.1-18.oe2003sp4
27.1-18.oe2003sp4
emacs
Red Hat:enterprise_linux:8::appstream
 before 1:26.1-15.el8_10.2
1:26.1-15.el8_10.2
emacs-common
Red Hat:enterprise_linux:8::appstream
 before 1:26.1-15.el8_10.2
1:26.1-15.el8_10.2
emacs-common-debuginfo
Red Hat:enterprise_linux:8::appstream
 before 1:26.1-15.el8_10.2
1:26.1-15.el8_10.2
emacs-debuginfo
Red Hat:enterprise_linux:8::appstream
 before 1:26.1-15.el8_10.2
1:26.1-15.el8_10.2
emacs-debugsource
Red Hat:enterprise_linux:8::appstream
 before 1:26.1-15.el8_10.2
1:26.1-15.el8_10.2
emacs-lucid
Red Hat:enterprise_linux:8::appstream
 before 1:26.1-15.el8_10.2
1:26.1-15.el8_10.2
emacs-lucid-debuginfo
Red Hat:enterprise_linux:8::appstream
 before 1:26.1-15.el8_10.2
1:26.1-15.el8_10.2
emacs-nox
Red Hat:enterprise_linux:8::appstream
 before 1:26.1-15.el8_10.2
1:26.1-15.el8_10.2
emacs-nox-debuginfo
Red Hat:enterprise_linux:8::appstream
 before 1:26.1-15.el8_10.2
1:26.1-15.el8_10.2
emacs-terminal
Red Hat:enterprise_linux:8::appstream
 before 1:26.1-15.el8_10.2
1:26.1-15.el8_10.2
emacs
Red Hat:enterprise_linux:8::baseos
 before 1:26.1-15.el8_10.2
1:26.1-15.el8_10.2
emacs-filesystem
Red Hat:enterprise_linux:8::baseos
 before 1:26.1-15.el8_10.2
1:26.1-15.el8_10.2
emacs
Red Hat:enterprise_linux:9::appstream
 before 1:27.2-18.el9_8.2
1:27.2-18.el9_8.2
emacs-common
Red Hat:enterprise_linux:9::appstream
 before 1:27.2-18.el9_8.2
1:27.2-18.el9_8.2
emacs-common-debuginfo
Red Hat:enterprise_linux:9::appstream
 before 1:27.2-18.el9_8.2
1:27.2-18.el9_8.2
emacs-debuginfo
Red Hat:enterprise_linux:9::appstream
 before 1:27.2-18.el9_8.2
1:27.2-18.el9_8.2
emacs-debugsource
Red Hat:enterprise_linux:9::appstream
 before 1:27.2-18.el9_8.2
1:27.2-18.el9_8.2
emacs-filesystem
Red Hat:enterprise_linux:9::appstream
 before 1:27.2-18.el9_8.2
1:27.2-18.el9_8.2
emacs-lucid
Red Hat:enterprise_linux:9::appstream
 before 1:27.2-18.el9_8.2
1:27.2-18.el9_8.2
emacs-lucid-debuginfo
Red Hat:enterprise_linux:9::appstream
 before 1:27.2-18.el9_8.2
1:27.2-18.el9_8.2
emacs-nox
Red Hat:enterprise_linux:9::appstream
 before 1:27.2-18.el9_8.2
1:27.2-18.el9_8.2
emacs-nox-debuginfo
Red Hat:enterprise_linux:9::appstream
 before 1:27.2-18.el9_8.2
1:27.2-18.el9_8.2
emacs
Red Hat:enterprise_linux:10.2
 before 1:29.4-14.el10_2.3
1:29.4-14.el10_2.3
emacs-common
Red Hat:enterprise_linux:10.2
 before 1:29.4-14.el10_2.3
1:29.4-14.el10_2.3
emacs-common-debuginfo
Red Hat:enterprise_linux:10.2
 before 1:29.4-14.el10_2.3
1:29.4-14.el10_2.3
emacs-debuginfo
Red Hat:enterprise_linux:10.2
 before 1:29.4-14.el10_2.3
1:29.4-14.el10_2.3
emacs-debugsource
Red Hat:enterprise_linux:10.2
 before 1:29.4-14.el10_2.3
1:29.4-14.el10_2.3
emacs-gtk+x11-debuginfo
Red Hat:enterprise_linux:10.2
 before 1:29.4-14.el10_2.3
1:29.4-14.el10_2.3
emacs-lucid
Red Hat:enterprise_linux:10.2
 before 1:29.4-14.el10_2.3
1:29.4-14.el10_2.3
emacs-lucid-debuginfo
Red Hat:enterprise_linux:10.2
 before 1:29.4-14.el10_2.3
1:29.4-14.el10_2.3
emacs-nw
Red Hat:enterprise_linux:10.2
 before 1:29.4-14.el10_2.3
1:29.4-14.el10_2.3
emacs-nw-debuginfo
Red Hat:enterprise_linux:10.2
 before 1:29.4-14.el10_2.3
1:29.4-14.el10_2.3
emacs-filesystem
Red Hat:enterprise_linux:10.2
 before 1:29.4-14.el10_2.3
1:29.4-14.el10_2.3
emacs
Rocky Linux:8
 before 1:26.1-15.el8_10.2
1:26.1-15.el8_10.2
emacs
Rocky Linux:9
 before 1:27.2-18.el9_8.2
1:27.2-18.el9_8.2
emacs
Rocky Linux:10
 before 1:29.4-14.el10_2.3
1:29.4-14.el10_2.3
emacs
SUSE:Linux Enterprise Server 16.0
 before 30.2-160000.3.1
30.2-160000.3.1
emacs
SUSE:Linux Enterprise Server for SAP applications 16.0
 before 30.2-160000.3.1
30.2-160000.3.1
emacs
SUSE:Linux Enterprise Server 12 SP5-LTSS
 before 24.3-25.26.1
24.3-25.26.1
emacs
SUSE:Linux Enterprise Server LTSS Extended Security 12 SP5
 before 24.3-25.26.1
24.3-25.26.1
emacs
SUSE:Linux Enterprise Module for Basesystem 15 SP7
 before 27.2-150400.3.31.2
27.2-150400.3.31.2
emacs
SUSE:Linux Enterprise Module for Desktop Applications 15 SP7
 before 27.2-150400.3.31.2
27.2-150400.3.31.2
emacs
SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS
 before 27.2-150400.3.31.2
27.2-150400.3.31.2
emacs
SUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS
 before 27.2-150400.3.31.2
27.2-150400.3.31.2
emacs
SUSE:Linux Enterprise High Performance Computing 15 SP5-ESPOS
 before 27.2-150400.3.31.2
27.2-150400.3.31.2
emacs
SUSE:Linux Enterprise High Performance Computing 15 SP5-LTSS
 before 27.2-150400.3.31.2
27.2-150400.3.31.2
emacs
SUSE:Linux Enterprise Server 15 SP4-LTSS
 before 27.2-150400.3.31.2
27.2-150400.3.31.2
emacs
SUSE:Linux Enterprise Server 15 SP5-LTSS
 before 27.2-150400.3.31.2
27.2-150400.3.31.2
emacs
SUSE:Linux Enterprise Server 15 SP6-LTSS
 before 27.2-150400.3.31.2
27.2-150400.3.31.2
emacs
SUSE:Linux Enterprise Server for SAP Applications 15 SP4
 before 27.2-150400.3.31.2
27.2-150400.3.31.2
emacs
SUSE:Linux Enterprise Server for SAP Applications 15 SP5
 before 27.2-150400.3.31.2
27.2-150400.3.31.2
emacs
SUSE:Linux Enterprise Server for SAP Applications 15 SP6
 before 27.2-150400.3.31.2
27.2-150400.3.31.2
emacs24
Ubuntu:Pro:16.04:LTS
 All versions, plus listed versions
24.5+1-1ubuntu224.5+1-1ubuntu424.5+1-1ubuntu524.5+1-1ubuntu624.5+1-1ubuntu7
Show 6 moreShow less
24.5+1-6ubuntu124.5+1-6ubuntu1.124.5+1-6ubuntu1.1+esm124.5+1-6ubuntu1.1+esm224.5+1-6ubuntu1.1+esm324.5+1-6ubuntu1.1+esm4
 None known
xemacs21
Ubuntu:16.04:LTS
 All versions, plus listed versions
21.4.22-4ubuntu321.4.22-14ubuntu1
 None known
xemacs21-packages
Ubuntu:16.04:LTS
 All versions, plus listed versions
2009.02.17.dfsg.2-2
 None known
emacs25
Ubuntu:Pro:18.04:LTS
 All versions, plus listed versions
25.2+1-625.2+1-6ubuntu0.1~esm2
 None known
xemacs21
Ubuntu:18.04:LTS
 All versions, plus listed versions
21.4.24-4ubuntu121.4.24-5ubuntu1
 None known
xemacs21-packages
Ubuntu:18.04:LTS
 All versions, plus listed versions
2009.02.17.dfsg.2-4
 None known
emacs
Ubuntu:Pro:20.04:LTS
 All versions, plus listed versions
1:26.3+1-1ubuntu11:26.3+1-1ubuntu21:26.3+1-1ubuntu2+esm11:26.3+1-1ubuntu2+esm2
 None known
xemacs21
Ubuntu:20.04:LTS
 All versions, plus listed versions
21.4.24-8build121.4.24-9
 None known
xemacs21-packages
Ubuntu:20.04:LTS
 All versions, plus listed versions
2009.02.17.dfsg.2-42009.02.17.dfsg.2-5
 None known
xemacs21
Ubuntu:22.04:LTS
 All versions, plus listed versions
21.4.24-9ubuntu2
 None known
xemacs21-packages
Ubuntu:22.04:LTS
 All versions, plus listed versions
2009.02.17.dfsg.2-5
 None known
emacs
Ubuntu:Pro:22.04:LTS
 All versions, plus listed versions
1:27.1+1-3ubuntu31:27.1+1-3ubuntu51:27.1+1-3ubuntu5.11:27.1+1-3ubuntu5.21:27.1+1-3ubuntu5.2+esm1
 None known
xemacs21
Ubuntu:24.04:LTS
 All versions, plus listed versions
21.4.24-1221.4.24-12build221.4.24-12build3
 None known
xemacs21-packages
Ubuntu:24.04:LTS
 All versions, plus listed versions
2009.02.17.dfsg.3-22009.02.17.dfsg.3-3
 None known
emacs
Ubuntu:Pro:24.04:LTS
 All versions, plus listed versions
1:29.1+1-5ubuntu11:29.2+1-1ubuntu11:29.2+1-2ubuntu41:29.3+1-1ubuntu21:29.3+1-1ubuntu2+esm11:29.3+1-1ubuntu2+esm31:29.3+1-1ubuntu2+esm4
 None known
emacs
Ubuntu:26.10
 All versions, plus listed versions
1:30.2+1-2ubuntu11:30.2+1-6ubuntu11:30.2+1-11ubuntu1
 None known
xemacs21
Ubuntu:26.10
 All versions, plus listed versions
21.4.24-12build3
 None known
xemacs21-packages
Ubuntu:26.10
 All versions, plus listed versions
2009.02.17.dfsg.3-3build1
 None known
xemacs21
Ubuntu:26.04:LTS
 All versions, plus listed versions
21.4.24-12build3
 None known
xemacs21-packages
Ubuntu:26.04:LTS
 All versions, plus listed versions
2009.02.17.dfsg.3-32009.02.17.dfsg.3-3build1
 None known
emacs
Ubuntu:Pro:26.04:LTS
 All versions, plus listed versions
1:30.1+1-9ubuntu11:30.2+1-1ubuntu21:30.2+1-2ubuntu11:30.2+1-2ubuntu1+esm1
 None known
emacs
openSUSE:Leap 16.0
 before 30.2-160000.3.1
30.2-160000.3.1

History

History
RecordedChangedSources
first indexedCVE List, EUVD, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2026-77219 is a medium vulnerability (CVSS 6.9) in Gnu Emacs, published August 21, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.13%, the 2nd percentile. Fixed in emacs 1:26.1-15.el8_10.2.

References

Show 46 moreShow less
This page doesn't list everything

Left out here: 3 versions. The JSON record has them.

Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open