Every CVE Search/ Get API key

CVE-2017-14482

GNU Emacs before 25.3 allows remote attackers to execute arbitrary code via email with crafted ...

8.8 HighFix available

GNU Emacs before 25.3 allows remote attackers to execute arbitrary code via email with crafted "Content-Type: text/enriched" data containing an x-display XML element that specifies execution of shell commands, related to an unsafe text/enriched extension in lisp/textmodes/enriched.el, and unsafe Gnus support for enriched and richtext inline MIME objects in lisp/gnus/mm-view.el. In particular, an Emacs user can be instantly compromised by reading a crafted email message (or Usenet news article).

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
Low
Privileges needed
None
User interaction
Required

What an attacker can affect

Confidentiality
High
Integrity
High
Availability
High

Exploit likelihood

4.01%Unchanged since Apr 14, 2021
90%50%10%1%

What each source reports

NVD Score used 8.8

GNU Emacs before 25.3 allows remote attackers to execute arbitrary code via email with crafted "Content-Type: text/enriched" data containing an x-display XML element that specifies execution of shell commands, related to an unsafe text/enriched extension in lisp/textmodes/enriched.el, and unsafe Gnus support for enriched and richtext inline MIME objects in lisp/gnus/mm-view.el. In particular, an Emacs user can be instantly compromised by reading a crafted email message (or Usenet news article).

Record
CVE-2017-14482
CVSS 3.0
8.8 HighCVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
CVSS 2.0
6.8 MediumAV:N/AC:M/Au:N/C:P/I:P/A:P
Updated
2026-11-02
CVE List No score

GNU Emacs before 25.3 allows remote attackers to execute arbitrary code via email with crafted "Content-Type: text/enriched" data containing an x-display XML element that specifies execution of shell commands, related to an unsafe text/enriched extension in lisp/textmodes/enriched.el, and unsafe Gnus support for enriched and richtext inline MIME objects in lisp/gnus/mm-view.el. In particular, an Emacs user can be instantly compromised by reading a crafted email message (or Usenet news article).

Record
CVE-2017-14482
Updated
2026-11-02
EUVDEUVD-2017-5985 No score

GNU Emacs before 25.3 allows remote attackers to execute arbitrary code via email with crafted "Content-Type: text/enriched" data containing an x-display XML element that specifies execution of shell commands, related to an unsafe text/enriched extension in lisp/textmodes/enriched.el, and unsafe Gnus support for enriched and richtext inline MIME objects in lisp/gnus/mm-view.el. In particular, an Emacs user can be instantly compromised by reading a crafted email message (or Usenet news article).

Record
EUVD-2017-5985
Updated
2026-11-03
GitHub AdvisoriesGHSA-2v7h-5r83-vh8r 8.8

GNU Emacs before 25.3 allows remote attackers to execute arbitrary code via email with crafted ...

GNU Emacs before 25.3 allows remote attackers to execute arbitrary code via email with crafted "Content-Type: text/enriched" data containing an x-display XML element that specifies execution of shell commands, related to an unsafe text/enriched extension in lisp/textmodes/enriched.el, and unsafe Gnus support for enriched and richtext inline MIME objects in lisp/gnus/mm-view.el. In particular, an Emacs user can be instantly compromised by reading a crafted email message (or Usenet news article).

Record
GHSA-2v7h-5r83-vh8r
CVSS 3.0
8.8 HighCVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVRHSA-2017:2771 8.1

Red Hat Security Advisory: emacs security update

Record
RHSA-2017:2771
CVSS 3.0
8.1 HighCVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVUBUNTU-CVE-2017-14482 8.8

GNU Emacs before 25.3 allows remote attackers to execute arbitrary code via email with crafted "Content-Type: text/enriched" data containing an x-display XML element that specifies execution of shell commands, related to an unsafe text/enriched extension in lisp/textmodes/enriched.el, and unsafe Gnus support for enriched and richtext inline MIME objects in lisp/gnus/mm-view.el. In particular, an Emacs user can be instantly compromised by reading a crafted email message (or Usenet news article).

Record
UBUNTU-CVE-2017-14482
CVSS 3.0
8.8 HighCVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Updated
2026-11-02
Show 4 moreShow less
OSVMGASA-2017-0476 No score

Updated emacs packages fix security vulnerability

Charles A. Roelli discovered that Emacs is vulnerable to arbitrary code execution when rendering text/enriched MIME data (e.g. when using Emacs-based mail clients) (CVE-2017-14482).

Record
MGASA-2017-0476
Updated
2026-11-02
OSVSUSE-SU-2017:2529-1 No score

Security update for emacs

This update for emacs fixes one issues.

This security issue was fixed:

  • CVE-2017-14482: Remote code execution via mails with 'Content-Type: text/enriched' (bsc#1058425)
Record
SUSE-SU-2017:2529-1
Updated
2026-11-02
OSVSUSE-SU-2017:2532-1 No score

Security update for emacs

This update for emacs fixes one issues.

This security issue was fixed:

  • CVE-2017-14482: Remote code execution via mails with 'Content-Type: text/enriched' (bsc#1058425)
Record
SUSE-SU-2017:2532-1
Updated
2026-11-02
OSVUSN-3427-1 No score

emacs24 vulnerability

Charles A. Roelli discovered that Emacs incorrectly handled certain files. If a user were tricked into opening a specially crafted file (e.g., email messages in gnus), an attacker could possibly use this to execute arbitrary code.

Record
USN-3427-1
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
emacs23
Debian:7
 before 23.4+1-4+deb7u1, plus listed versions
23.4+1-4
23.4+1-4+deb7u1
emacs24
Debian:8
 before 24.4+1-5+deb8u1, plus listed versions
24.4+1-5
24.4+1-5+deb8u1
emacs24
Debian:9
 before 24.5+1-11+deb9u1, plus listed versions
24.5+1-11
24.5+1-11+deb9u1
emacs25
Debian:9
 before 25.1+1-4+deb9u1, plus listed versions
25.1+1-4
25.1+1-4+deb9u1
emacs
Mageia:5
 before 24.3-10.1.mga5
24.3-10.1.mga5
emacs
Mageia:6
 before 24.5-8.1.mga6
24.5-8.1.mga6
emacs
Red Hat:enterprise_linux:7::client
 before 1:24.3-20.el7_4
1:24.3-20.el7_4
emacs-common
Red Hat:enterprise_linux:7::client
 before 1:24.3-20.el7_4
1:24.3-20.el7_4
emacs-debuginfo
Red Hat:enterprise_linux:7::client
 before 1:24.3-20.el7_4
1:24.3-20.el7_4
emacs-filesystem
Red Hat:enterprise_linux:7::client
 before 1:24.3-20.el7_4
1:24.3-20.el7_4
Show 43 moreShow less
Affected packages
PackageAffectedFixed
emacs-nox
Red Hat:enterprise_linux:7::client
 before 1:24.3-20.el7_4
1:24.3-20.el7_4
emacs-el
Red Hat:enterprise_linux:7::client
 before 1:24.3-20.el7_4
1:24.3-20.el7_4
emacs-terminal
Red Hat:enterprise_linux:7::client
 before 1:24.3-20.el7_4
1:24.3-20.el7_4
emacs
Red Hat:enterprise_linux:7::computenode
 before 1:24.3-20.el7_4
1:24.3-20.el7_4
emacs-filesystem
Red Hat:enterprise_linux:7::computenode
 before 1:24.3-20.el7_4
1:24.3-20.el7_4
emacs-common
Red Hat:enterprise_linux:7::computenode
 before 1:24.3-20.el7_4
1:24.3-20.el7_4
emacs-debuginfo
Red Hat:enterprise_linux:7::computenode
 before 1:24.3-20.el7_4
1:24.3-20.el7_4
emacs-el
Red Hat:enterprise_linux:7::computenode
 before 1:24.3-20.el7_4
1:24.3-20.el7_4
emacs-nox
Red Hat:enterprise_linux:7::computenode
 before 1:24.3-20.el7_4
1:24.3-20.el7_4
emacs-terminal
Red Hat:enterprise_linux:7::computenode
 before 1:24.3-20.el7_4
1:24.3-20.el7_4
emacs
Red Hat:enterprise_linux:7::server
 before 1:24.3-20.el7_4
1:24.3-20.el7_4
emacs-common
Red Hat:enterprise_linux:7::server
 before 1:24.3-20.el7_4
1:24.3-20.el7_4
emacs-debuginfo
Red Hat:enterprise_linux:7::server
 before 1:24.3-20.el7_4
1:24.3-20.el7_4
emacs-filesystem
Red Hat:enterprise_linux:7::server
 before 1:24.3-20.el7_4
1:24.3-20.el7_4
emacs-nox
Red Hat:enterprise_linux:7::server
 before 1:24.3-20.el7_4
1:24.3-20.el7_4
emacs-el
Red Hat:enterprise_linux:7::server
 before 1:24.3-20.el7_4
1:24.3-20.el7_4
emacs-terminal
Red Hat:enterprise_linux:7::server
 before 1:24.3-20.el7_4
1:24.3-20.el7_4
emacs
Red Hat:enterprise_linux:7::workstation
 before 1:24.3-20.el7_4
1:24.3-20.el7_4
emacs-common
Red Hat:enterprise_linux:7::workstation
 before 1:24.3-20.el7_4
1:24.3-20.el7_4
emacs-debuginfo
Red Hat:enterprise_linux:7::workstation
 before 1:24.3-20.el7_4
1:24.3-20.el7_4
emacs-filesystem
Red Hat:enterprise_linux:7::workstation
 before 1:24.3-20.el7_4
1:24.3-20.el7_4
emacs-nox
Red Hat:enterprise_linux:7::workstation
 before 1:24.3-20.el7_4
1:24.3-20.el7_4
emacs-el
Red Hat:enterprise_linux:7::workstation
 before 1:24.3-20.el7_4
1:24.3-20.el7_4
emacs-terminal
Red Hat:enterprise_linux:7::workstation
 before 1:24.3-20.el7_4
1:24.3-20.el7_4
emacs
SUSE:OpenStack Cloud 6
 before 24.3-25.3.1
24.3-25.3.1
emacs
SUSE:Linux Enterprise Desktop 12 SP2
 before 24.3-25.3.1
24.3-25.3.1
emacs
SUSE:Linux Enterprise Desktop 12 SP3
 before 24.3-25.3.1
24.3-25.3.1
emacs
SUSE:Linux Enterprise Server for Raspberry Pi 12 SP2
 before 24.3-25.3.1
24.3-25.3.1
emacs
SUSE:Linux Enterprise Server for SAP Applications 12 SP1
 before 24.3-25.3.1
24.3-25.3.1
emacs
SUSE:Linux Enterprise Server 12-LTSS
 before 24.3-25.3.1
24.3-25.3.1
emacs
SUSE:Linux Enterprise Server 12 SP1-LTSS
 before 24.3-25.3.1
24.3-25.3.1
emacs
SUSE:Linux Enterprise Server 12 SP2
 before 24.3-25.3.1
24.3-25.3.1
emacs
SUSE:Linux Enterprise Server for SAP Applications 12 SP2
 before 24.3-25.3.1
24.3-25.3.1
emacs
SUSE:Linux Enterprise Server 12 SP3
 before 24.3-25.3.1
24.3-25.3.1
emacs
SUSE:Linux Enterprise Server for SAP Applications 12 SP3
 before 24.3-25.3.1
24.3-25.3.1
emacs
SUSE:Linux Enterprise Software Development Kit 11 SP4
 before 22.3-42.3.1
22.3-42.3.1
emacs
SUSE:Linux Enterprise Point of Sale 11 SP3
 before 22.3-42.3.1
22.3-42.3.1
emacs
SUSE:Linux Enterprise Server 11 SP3-LTSS
 before 22.3-42.3.1
22.3-42.3.1
emacs
SUSE:Linux Enterprise Server 11 SP3-TERADATA
 before 22.3-42.3.1
22.3-42.3.1
emacs
SUSE:Linux Enterprise Server 11 SP4
 before 22.3-42.3.1
22.3-42.3.1
emacs
SUSE:Linux Enterprise Server for SAP Applications 11 SP4
 before 22.3-42.3.1
22.3-42.3.1
emacs24
Ubuntu:14.04:LTS
 before 24.3+1-2ubuntu1.1, plus listed versions
24.3+1-1ubuntu324.3+1-2ubuntu1
24.3+1-2ubuntu1.1
emacs24
Ubuntu:16.04:LTS
 before 24.5+1-6ubuntu1.1, plus listed versions
24.5+1-1ubuntu224.5+1-1ubuntu424.5+1-1ubuntu524.5+1-1ubuntu624.5+1-1ubuntu724.5+1-6ubuntu1
24.5+1-6ubuntu1.1

History

History
RecordedChangedSources
aliasesEUVD
first indexedCVE List, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2017-14482 is a high vulnerability (CVSS 8.8) in Gnu Emacs, published September 12, 2017. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 4.01%, the 90th percentile. Fixed in emacs23 23.4+1-4+deb7u1.

References

Show 18 moreShow less
Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open