CVE-2026-96269
GNU Emacs 28.1 through 31.1 allows arbitrary code execution upon opening a file, because an...
GNU Emacs 28.1 through 31.1 allows arbitrary code execution upon opening a file, because an untrusted value of read-symbol-shorthands affects the intern and unintern functions. This affects the default configuration; no particular user settings are required to trigger it.
Attack profile
How easy it is to exploit
- Attack vector
- Local
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- High
- Integrity
- High
- Availability
- High
Exploit likelihood
What each source reports
CVE List Score used
GNU Emacs 28.1 through 31.1 allows arbitrary code execution upon opening a file, because an untrusted value of read-symbol-shorthands affects the intern and unintern functions. This affects the default configuration; no particular user settings are required to trigger it.
- Record
CVE-2026-96269- CVSS 4.0
- 7.5 High
CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N - Weakness
- CWE-829
- Updated
- 2026-11-02
EUVDEUVD-2026-84868
GNU Emacs 28.1 through 31.1 allows arbitrary code execution upon opening a file, because an untrusted value of read-symbol-shorthands affects the intern and unintern functions. This affects the default configuration; no particular user settings are required to trigger it.
- Record
EUVD-2026-84868- CVSS 4.0
- 7.5 High
CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N - Updated
- 2026-11-02
GitHub AdvisoriesGHSA-29x7-3q83-3x3v
GNU Emacs 28.1 through 31.1 allows arbitrary code execution upon opening a file, because an...
GNU Emacs 28.1 through 31.1 allows arbitrary code execution upon opening a file, because an untrusted value of read-symbol-shorthands affects the intern and unintern functions. This affects the default configuration; no particular user settings are required to trigger it.
- Record
GHSA-29x7-3q83-3x3v- CVSS 4.0
- 7.5 High
CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X - Weakness
- CWE-829
- Updated
- 2026-11-02
NVD
GNU Emacs 28.1 through 31.1 allows arbitrary code execution upon opening a file, because an untrusted value of read-symbol-shorthands affects the intern and unintern functions. This affects the default configuration; no particular user settings are required to trigger it.
- Record
CVE-2026-96269- CVSS 4.0
- 7.5 High
CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X - Weakness
- CWE-829
- Updated
- 2026-11-02
OSVDEBIAN-CVE-2026-96269
GNU Emacs 28.1 through 31.1 allows arbitrary code execution upon opening a file, because an untrusted value of read-symbol-shorthands affects the intern and unintern functions. This affects the default configuration; no particular user settings are required to trigger it.
- Record
DEBIAN-CVE-2026-96269- CVSS 4.0
- 7.5 High
CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X - Updated
- 2026-11-02
OSVRLSA-2026:90887
Important: emacs security update
GNU Emacs is a powerful, customizable, self-documenting text editor. It provides special code editing features, a scripting language (elisp), and the capability to read e-mail and news.
Security Fix(es):
- emacs: GNU Emacs: Arbitrary code execution upon opening a file (CVE-2026-96269)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
- Record
RLSA-2026:90887- CVSS 3.1
- 7.8 High
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVUBUNTU-CVE-2026-96269
GNU Emacs 28.1 through 31.1 allows arbitrary code execution upon opening a file, because an untrusted value of read-symbol-shorthands affects the intern and unintern functions. This affects the default configuration; no particular user settings are required to trigger it.
- Record
UBUNTU-CVE-2026-96269- CVSS 4.0
- 7.5 High
CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N - Updated
- 2026-11-02
OSVALSA-2026:90887 No score
Important: emacs security update
GNU Emacs is a powerful, customizable, self-documenting text editor. It provides special code editing features, a scripting language (elisp), and the capability to read e-mail and news.
Security Fix(es):
- emacs: GNU Emacs: Arbitrary code execution upon opening a file (CVE-2026-96269)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
- Record
ALSA-2026:90887- Updated
- 2026-11-02
OSVAZL-103410 No score
CVE-2026-96269 affecting package emacs for versions less than 29.4-7
GNU Emacs 28.1 through 31.1 allows arbitrary code execution upon opening a file, because an untrusted value of read-symbol-shorthands affects the intern and unintern functions. This affects the default configuration; no particular user settings are required to trigger it.
- Record
AZL-103410- Updated
- 2026-11-05
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
emacsAlmaLinux:10 |
before 1:29.4-14.el10_2.4 | 1:29.4-14.el10_2.4 |
emacs-commonAlmaLinux:10 |
before 1:29.4-14.el10_2.4 | 1:29.4-14.el10_2.4 |
emacs-filesystemAlmaLinux:10 |
before 1:29.4-14.el10_2.4 | 1:29.4-14.el10_2.4 |
emacs-lucidAlmaLinux:10 |
before 1:29.4-14.el10_2.4 | 1:29.4-14.el10_2.4 |
emacs-nwAlmaLinux:10 |
before 1:29.4-14.el10_2.4 | 1:29.4-14.el10_2.4 |
emacsAzure Linux:3 |
before 29.4-7 | 29.4-7 |
emacsDebian:12 |
All versions, plus listed versions 1:28.2+1-151:28.2+1-15+deb12u11:28.2+1-15+deb12u21:28.2+1-15+deb12u31:28.2+1-15+deb12u4 Show 45 moreShow less1:28.2+1-161:29.1+1-11:29.1+1-21:29.1+1-31:29.1+1-41:29.1+1-51:29.1+1-5~bpo12+11:29.2+1-11:29.2+1-21:29.2+1-2~bpo12+11:29.3+1-11:29.3+1-21:29.3+1-2~bpo12+11:29.3+1-31:29.3+1-3~bpo12+11:29.4+1-11:29.4+1-21:29.4+1-2~bpo12+11:29.4+1-31:29.4+1-41:29.4+1-4~bpo12+11:29.4+1-51:29.4+1-61:29.4+1-6+alpha1:30.1+1-11:30.1+1-21:30.1+1-31:30.1+1-3~bpo12+11:30.1+1-41:30.1+1-4~bpo12+11:30.1+1-51:30.1+1-5~bpo12+11:30.1+1-61:30.1+1-6~bpo12+11:30.1+1-71:30.1+1-81:30.1+1-91:30.2+1-11:30.2+1-101:30.2+1-111:30.2+1-21:30.2+1-31:30.2+1-41:30.2+1-51:30.2+1-6 |
None known |
emacsDebian:13 |
before 1:30.1+1-6+deb13u1, plus listed versions 1:30.1+1-6 |
1:30.1+1-6+deb13u1 |
emacsDebian:14 |
before 1:30.2+1-11, plus listed versions 1:30.1+1-61:30.1+1-71:30.1+1-81:30.1+1-91:30.2+1-1 Show 9 moreShow less1:30.2+1-101:30.2+1-21:30.2+1-31:30.2+1-41:30.2+1-51:30.2+1-61:30.2+1-71:30.2+1-81:30.2+1-9 |
1:30.2+1-11 |
emacsRocky Linux:10 |
before 1:29.4-14.el10_2.4 | 1:29.4-14.el10_2.4 |
Show 21 moreShow less
| Package | Affected | Fixed |
|---|---|---|
emacs24Ubuntu:Pro:16.04:LTS |
All versions, plus listed versions 24.5+1-1ubuntu224.5+1-1ubuntu424.5+1-1ubuntu524.5+1-1ubuntu624.5+1-1ubuntu7 Show 6 moreShow less24.5+1-6ubuntu124.5+1-6ubuntu1.124.5+1-6ubuntu1.1+esm124.5+1-6ubuntu1.1+esm224.5+1-6ubuntu1.1+esm324.5+1-6ubuntu1.1+esm4 |
None known |
xemacs21Ubuntu:16.04:LTS |
All versions, plus listed versions 21.4.22-4ubuntu321.4.22-14ubuntu1 |
None known |
xemacs21-packagesUbuntu:16.04:LTS |
All versions, plus listed versions 2009.02.17.dfsg.2-2 |
None known |
emacs25Ubuntu:Pro:18.04:LTS |
All versions, plus listed versions 25.2+1-625.2+1-6ubuntu0.1~esm2 |
None known |
xemacs21Ubuntu:18.04:LTS |
All versions, plus listed versions 21.4.24-4ubuntu121.4.24-5ubuntu1 |
None known |
xemacs21-packagesUbuntu:18.04:LTS |
All versions, plus listed versions 2009.02.17.dfsg.2-4 |
None known |
emacsUbuntu:Pro:20.04:LTS |
All versions, plus listed versions 1:26.3+1-1ubuntu11:26.3+1-1ubuntu21:26.3+1-1ubuntu2+esm11:26.3+1-1ubuntu2+esm2 |
None known |
xemacs21Ubuntu:20.04:LTS |
All versions, plus listed versions 21.4.24-8build121.4.24-9 |
None known |
xemacs21-packagesUbuntu:20.04:LTS |
All versions, plus listed versions 2009.02.17.dfsg.2-42009.02.17.dfsg.2-5 |
None known |
xemacs21Ubuntu:22.04:LTS |
All versions, plus listed versions 21.4.24-9ubuntu2 |
None known |
xemacs21-packagesUbuntu:22.04:LTS |
All versions, plus listed versions 2009.02.17.dfsg.2-5 |
None known |
emacsUbuntu:Pro:22.04:LTS |
All versions, plus listed versions 1:27.1+1-3ubuntu31:27.1+1-3ubuntu51:27.1+1-3ubuntu5.11:27.1+1-3ubuntu5.21:27.1+1-3ubuntu5.2+esm1 |
None known |
xemacs21Ubuntu:24.04:LTS |
All versions, plus listed versions 21.4.24-1221.4.24-12build221.4.24-12build3 |
None known |
xemacs21-packagesUbuntu:24.04:LTS |
All versions, plus listed versions 2009.02.17.dfsg.3-22009.02.17.dfsg.3-3 |
None known |
emacsUbuntu:Pro:24.04:LTS |
All versions, plus listed versions 1:29.1+1-5ubuntu11:29.2+1-1ubuntu11:29.2+1-2ubuntu41:29.3+1-1ubuntu21:29.3+1-1ubuntu2+esm11:29.3+1-1ubuntu2+esm31:29.3+1-1ubuntu2+esm4 |
None known |
emacsUbuntu:26.10 |
All versions, plus listed versions 1:30.2+1-2ubuntu11:30.2+1-6ubuntu11:30.2+1-11ubuntu1 |
None known |
xemacs21Ubuntu:26.10 |
All versions, plus listed versions 21.4.24-12build3 |
None known |
xemacs21-packagesUbuntu:26.10 |
All versions, plus listed versions 2009.02.17.dfsg.3-3build1 |
None known |
xemacs21Ubuntu:26.04:LTS |
All versions, plus listed versions 21.4.24-12build3 |
None known |
xemacs21-packagesUbuntu:26.04:LTS |
All versions, plus listed versions 2009.02.17.dfsg.3-32009.02.17.dfsg.3-3build1 |
None known |
emacsUbuntu:Pro:26.04:LTS |
All versions, plus listed versions 1:30.1+1-9ubuntu11:30.2+1-1ubuntu21:30.2+1-2ubuntu11:30.2+1-2ubuntu1+esm1 |
None known |
History
| Recorded | Changed | Sources |
|---|---|---|
| facts | OSV | |
| first indexed | CVE List, EUVD, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2026-96269 is a high vulnerability (CVSS 7.5) in Gnu Emacs, published September 22, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.14%, the 3rd percentile. Fixed in emacs 1:29.4-14.el10_2.4.
References
yhetil.org/emacs/jwvtsph1aoj.fsf-monnier+[email protected]/T
debbugs.gnu.org/cgi/bugreport.cgi?bug=80574
eshelyaron.com/posts/2026-08-06-emacs-arbitrary-code-execution-returns.html
openwall.com/lists/oss-security/2026/08/20/3
nvd.nist.gov/vuln/detail/CVE-2026-96269
github.com/advisories/GHSA-29x7-3q83-3x3v
Show 9 moreShow less
access.redhat.com/errata/RHSA-2026:90887
bugzilla.redhat.com/2538925
errata.almalinux.org/10/ALSA-2026-90887.html
security-tracker.debian.org/tracker/CVE-2026-96269
errata.rockylinux.org/RLSA-2026:90887
ubuntu.com/security/CVE-2026-96269
cve.org/CVERecord?id=CVE-2026-96269
Left out here: 3 versions. The JSON record has them.