CVE-2003-1232

Emacs 21.2.1 does not prompt or warn the user before executing Lisp code in the local variables...

5.1 MediumPublic exploit

Emacs 21.2.1 does not prompt or warn the user before executing Lisp code in the local variables section of a text file, which allows user-assisted attackers to execute arbitrary commands, as demonstrated using the mode-name variable.

Exploit likelihood

3.01%Down 3.8 points since Feb 4, 2022

What each source reports

NVD Score used 5.1

Record: CVE-2003-1232
CVSS 2.0: 5.1 MediumAV:N/AC:H/Au:N/C:P/I:P/A:P
Updated: 2026-11-02

CVE List No score

Record: CVE-2003-1232
Updated: 2026-11-02

EUVDEUVD-2003-1222 No score

Record: EUVD-2003-1222
Updated: 2026-11-03

GitHub AdvisoriesGHSA-7vjq-vrv9-8wc8 No score

Emacs 21.2.1 does not prompt or warn the user before executing Lisp code in the local variables...

Record: GHSA-7vjq-vrv9-8wc8
Updated: 2026-11-02

Affected products

gnu emacs

Public exploits

Links only. Every CVE stores no exploit code.

Public exploits
Source	Link	Date
Exploit-DB	Emacs 2.1 - Local Variable Arbitrary Command Execution	2002-12-31

History

History
Recorded	Changed	Sources
Nov 3, 2026	aliases	EUVD
Nov 2, 2026	first indexed	CVE List, Exploit-DB, GitHub Advisories, NVD

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2003-1232 is a medium vulnerability (CVSS 5.1) in Gnu Emacs, published December 31, 2003. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 3.01%, the 87th percentile. No source names a fixed version.