{"id":"CVE-2026-77219","aliases":["ALSA-2026:80506","ALSA-2026:80507","ALSA-2026:84591","AZL-96986","CLSA-2026-1792080478","DEBIAN-CVE-2026-77219","EUVD-2026-64138","GHSA-q8pr-2495-3jw7","OESA-2026-4083","RHSA-2026:80506","RHSA-2026:80507","RHSA-2026:84591","RLSA-2026:80506","RLSA-2026:80507","RLSA-2026:84591","SUSE-SU-2026:23589-1","SUSE-SU-2026:3993-1","SUSE-SU-2026:4083-1","UBUNTU-CVE-2026-77219","openSUSE-SU-2026:21711-1"],"status":"published","title":"GNU Emacs \u003c 31.0.91 Heap Over-Read via PBM/PPM/PGM Image Loader","description":"GNU Emacs before 31.0.91 contains an integer overflow in the PBM/PPM/PGM image loader that allows an attacker to leak heap memory contents by supplying a crafted image with large dimensions and an elevated max color index. The image loader multiplies image dimensions and channel count using signed integer arithmetic; for sufficiently large values, the result wraps to a negative number, bypassing the bounds check and causing the pixel reader to access heap memory past the end of the allocated buffer. The over-read contents are interpreted as pixel color values and rendered on screen.","severity":{"version":"4.0","score":6.9,"vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:N/VA:H/SC:N/SI:N/SA:N","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-12","score":0.00128,"percentile":0.02524,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-125","CWE-190"],"published":"2026-08-21T20:20:45Z","modified":"2026-11-05T05:40:51Z","fixes":[{"ecosystem":"Azure Linux:3","package":"emacs","fixed_in":["29.4-6"],"sources":["osv"]},{"ecosystem":"openEuler:22.03-LTS-SP4","package":"emacs","fixed_in":["27.2-19.oe2203sp4"],"sources":["osv"]},{"ecosystem":"openEuler:24.03-LTS-SP1","package":"emacs","fixed_in":["29.1-9.oe2403sp1"],"sources":["osv"]},{"ecosystem":"openEuler:24.03-LTS-SP3","package":"emacs","fixed_in":["29.1-9.oe2403sp3"],"sources":["osv"]},{"ecosystem":"openEuler:24.03-LTS-SP4","package":"emacs","fixed_in":["29.1-10.oe2403sp4"],"sources":["osv"]},{"ecosystem":"openEuler:20.03-LTS-SP4","package":"emacs","fixed_in":["27.1-18.oe2003sp4"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"AlmaLinux:8","package":"emacs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:26.1-15.el8_10.2"}]}],"bundled":2},{"source":"osv","ecosystem":"AlmaLinux:8","package":"emacs-common","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:26.1-15.el8_10.2"}]}],"bundled":2},{"source":"osv","ecosystem":"AlmaLinux:8","package":"emacs-filesystem","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:26.1-15.el8_10.2"}]}],"bundled":2},{"source":"osv","ecosystem":"AlmaLinux:8","package":"emacs-lucid","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:26.1-15.el8_10.2"}]}],"bundled":2},{"source":"osv","ecosystem":"AlmaLinux:8","package":"emacs-nox","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:26.1-15.el8_10.2"}]}],"bundled":2},{"source":"osv","ecosystem":"AlmaLinux:8","package":"emacs-terminal","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:26.1-15.el8_10.2"}]}],"bundled":2},{"source":"osv","ecosystem":"AlmaLinux:9","package":"emacs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:27.2-18.el9_8.2"}]}],"bundled":2},{"source":"osv","ecosystem":"AlmaLinux:9","package":"emacs-common","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:27.2-18.el9_8.2"}]}],"bundled":2},{"source":"osv","ecosystem":"AlmaLinux:9","package":"emacs-filesystem","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:27.2-18.el9_8.2"}]}],"bundled":2},{"source":"osv","ecosystem":"AlmaLinux:9","package":"emacs-lucid","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:27.2-18.el9_8.2"}]}],"bundled":2},{"source":"osv","ecosystem":"AlmaLinux:9","package":"emacs-nox","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:27.2-18.el9_8.2"}]}],"bundled":2},{"source":"osv","ecosystem":"AlmaLinux:10","package":"emacs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:29.4-14.el10_2.3"}]}],"bundled":3},{"source":"osv","ecosystem":"AlmaLinux:10","package":"emacs-common","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:29.4-14.el10_2.3"}]}],"bundled":3},{"source":"osv","ecosystem":"AlmaLinux:10","package":"emacs-filesystem","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:29.4-14.el10_2.3"}]}],"bundled":3},{"source":"osv","ecosystem":"AlmaLinux:10","package":"emacs-lucid","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:29.4-14.el10_2.3"}]}],"bundled":3},{"source":"osv","ecosystem":"AlmaLinux:10","package":"emacs-nw","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:29.4-14.el10_2.3"}]}],"bundled":3},{"source":"osv","ecosystem":"Azure Linux:3","package":"emacs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"29.4-6"}]}]},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"emacs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:27.2-8.el9_2.1.tuxcare.els7"}]}],"bundled":3},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"emacs-common","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:27.2-8.el9_2.1.tuxcare.els7"}]}],"bundled":3},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"emacs-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:27.2-8.el9_2.1.tuxcare.els7"}]}],"bundled":3},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"emacs-filesystem","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:27.2-8.el9_2.1.tuxcare.els7"}]}],"bundled":3},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"emacs-lucid","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:27.2-8.el9_2.1.tuxcare.els7"}]}],"bundled":3},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"emacs-nox","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:27.2-8.el9_2.1.tuxcare.els7"}]}],"bundled":3},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"emacs-terminal","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:27.2-8.el9_2.1.tuxcare.els7"}]}],"bundled":3},{"source":"osv","ecosystem":"Debian:12","package":"emacs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1:28.2+1-15","1:28.2+1-15+deb12u1","1:28.2+1-15+deb12u2","1:28.2+1-15+deb12u3","1:28.2+1-15+deb12u4","1:28.2+1-16","1:29.1+1-1","1:29.1+1-2","1:29.1+1-3","1:29.1+1-4","1:29.1+1-5","1:29.1+1-5~bpo12+1","1:29.2+1-1","1:29.2+1-2","1:29.2+1-2~bpo12+1","1:29.3+1-1","1:29.3+1-2","1:29.3+1-2~bpo12+1","1:29.3+1-3","1:29.3+1-3~bpo12+1","1:29.4+1-1","1:29.4+1-2","1:29.4+1-2~bpo12+1","1:29.4+1-3","1:29.4+1-4","1:29.4+1-4~bpo12+1","1:29.4+1-5","1:29.4+1-6","1:29.4+1-6+alpha","1:30.1+1-1","1:30.1+1-2","1:30.1+1-3","1:30.1+1-3~bpo12+1","1:30.1+1-4","1:30.1+1-4~bpo12+1","1:30.1+1-5","1:30.1+1-5~bpo12+1","1:30.1+1-6","1:30.1+1-6~bpo12+1","1:30.1+1-7","1:30.1+1-8","1:30.1+1-9","1:30.2+1-1","1:30.2+1-10","1:30.2+1-11","1:30.2+1-2","1:30.2+1-3","1:30.2+1-4","1:30.2+1-5","1:30.2+1-6","1:30.2+1-7","1:30.2+1-8","1:30.2+1-9"]},{"source":"osv","ecosystem":"Debian:13","package":"emacs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1:30.1+1-6","1:30.1+1-6+deb13u1","1:30.1+1-7","1:30.1+1-8","1:30.1+1-9","1:30.2+1-1","1:30.2+1-10","1:30.2+1-11","1:30.2+1-2","1:30.2+1-3","1:30.2+1-4","1:30.2+1-5","1:30.2+1-6","1:30.2+1-7","1:30.2+1-8","1:30.2+1-9"]},{"source":"osv","ecosystem":"Debian:14","package":"emacs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1:30.1+1-6","1:30.1+1-7","1:30.1+1-8","1:30.1+1-9","1:30.2+1-1","1:30.2+1-10","1:30.2+1-11","1:30.2+1-2","1:30.2+1-3","1:30.2+1-4","1:30.2+1-5","1:30.2+1-6","1:30.2+1-7","1:30.2+1-8","1:30.2+1-9"]},{"source":"osv","ecosystem":"openEuler:22.03-LTS-SP4","package":"emacs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"27.2-19.oe2203sp4"}]}]},{"source":"osv","ecosystem":"openEuler:24.03-LTS-SP1","package":"emacs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"29.1-9.oe2403sp1"}]}]},{"source":"osv","ecosystem":"openEuler:24.03-LTS-SP3","package":"emacs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"29.1-9.oe2403sp3"}]}]},{"source":"osv","ecosystem":"openEuler:24.03-LTS-SP4","package":"emacs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"29.1-10.oe2403sp4"}]}]},{"source":"osv","ecosystem":"openEuler:20.03-LTS-SP4","package":"emacs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"27.1-18.oe2003sp4"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"emacs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:26.1-15.el8_10.2"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"emacs-common","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:26.1-15.el8_10.2"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"emacs-common-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:26.1-15.el8_10.2"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"emacs-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:26.1-15.el8_10.2"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"emacs-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:26.1-15.el8_10.2"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"emacs-lucid","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:26.1-15.el8_10.2"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"emacs-lucid-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:26.1-15.el8_10.2"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"emacs-nox","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:26.1-15.el8_10.2"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"emacs-nox-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:26.1-15.el8_10.2"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"emacs-terminal","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:26.1-15.el8_10.2"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::baseos","package":"emacs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:26.1-15.el8_10.2"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::baseos","package":"emacs-filesystem","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:26.1-15.el8_10.2"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"emacs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:27.2-18.el9_8.2"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"emacs-common","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:27.2-18.el9_8.2"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"emacs-common-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:27.2-18.el9_8.2"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"emacs-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:27.2-18.el9_8.2"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"emacs-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:27.2-18.el9_8.2"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"emacs-filesystem","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:27.2-18.el9_8.2"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"emacs-lucid","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:27.2-18.el9_8.2"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"emacs-lucid-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:27.2-18.el9_8.2"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"emacs-nox","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:27.2-18.el9_8.2"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"emacs-nox-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:27.2-18.el9_8.2"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"emacs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:29.4-14.el10_2.3"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"emacs-common","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:29.4-14.el10_2.3"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"emacs-common-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:29.4-14.el10_2.3"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"emacs-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:29.4-14.el10_2.3"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"emacs-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:29.4-14.el10_2.3"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"emacs-gtk+x11-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:29.4-14.el10_2.3"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"emacs-lucid","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:29.4-14.el10_2.3"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"emacs-lucid-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:29.4-14.el10_2.3"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"emacs-nw","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:29.4-14.el10_2.3"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"emacs-nw-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:29.4-14.el10_2.3"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"emacs-filesystem","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:29.4-14.el10_2.3"}]}],"bundled":3},{"source":"osv","ecosystem":"Rocky Linux:8","package":"emacs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:26.1-15.el8_10.2"}]}],"bundled":2},{"source":"osv","ecosystem":"Rocky Linux:9","package":"emacs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:27.2-18.el9_8.2"}]}],"bundled":2},{"source":"osv","ecosystem":"Rocky Linux:10","package":"emacs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:29.4-14.el10_2.3"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 16.0","package":"emacs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"30.2-160000.3.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP applications 16.0","package":"emacs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"30.2-160000.3.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP5-LTSS","package":"emacs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"24.3-25.26.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server LTSS Extended Security 12 SP5","package":"emacs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"24.3-25.26.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP7","package":"emacs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"27.2-150400.3.31.2"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Desktop Applications 15 SP7","package":"emacs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"27.2-150400.3.31.2"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS","package":"emacs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"27.2-150400.3.31.2"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS","package":"emacs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"27.2-150400.3.31.2"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP5-ESPOS","package":"emacs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"27.2-150400.3.31.2"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP5-LTSS","package":"emacs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"27.2-150400.3.31.2"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP4-LTSS","package":"emacs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"27.2-150400.3.31.2"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP5-LTSS","package":"emacs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"27.2-150400.3.31.2"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP6-LTSS","package":"emacs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"27.2-150400.3.31.2"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP4","package":"emacs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"27.2-150400.3.31.2"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP5","package":"emacs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"27.2-150400.3.31.2"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP6","package":"emacs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"27.2-150400.3.31.2"}]}],"bundled":2},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"emacs24","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["24.5+1-1ubuntu2","24.5+1-1ubuntu4","24.5+1-1ubuntu5","24.5+1-1ubuntu6","24.5+1-1ubuntu7","24.5+1-6ubuntu1","24.5+1-6ubuntu1.1","24.5+1-6ubuntu1.1+esm1","24.5+1-6ubuntu1.1+esm2","24.5+1-6ubuntu1.1+esm3","24.5+1-6ubuntu1.1+esm4"]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"xemacs21","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["21.4.22-4ubuntu3","21.4.22-14ubuntu1"]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"xemacs21-packages","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2009.02.17.dfsg.2-2"]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"emacs25","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["25.2+1-6","25.2+1-6ubuntu0.1~esm2"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"xemacs21","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["21.4.24-4ubuntu1","21.4.24-5ubuntu1"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"xemacs21-packages","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2009.02.17.dfsg.2-4"]},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"emacs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1:26.3+1-1ubuntu1","1:26.3+1-1ubuntu2","1:26.3+1-1ubuntu2+esm1","1:26.3+1-1ubuntu2+esm2"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"xemacs21","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["21.4.24-8build1","21.4.24-9"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"xemacs21-packages","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2009.02.17.dfsg.2-4","2009.02.17.dfsg.2-5"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"xemacs21","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["21.4.24-9ubuntu2"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"xemacs21-packages","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2009.02.17.dfsg.2-5"]},{"source":"osv","ecosystem":"Ubuntu:Pro:22.04:LTS","package":"emacs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1:27.1+1-3ubuntu3","1:27.1+1-3ubuntu5","1:27.1+1-3ubuntu5.1","1:27.1+1-3ubuntu5.2","1:27.1+1-3ubuntu5.2+esm1"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"xemacs21","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["21.4.24-12","21.4.24-12build2","21.4.24-12build3"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"xemacs21-packages","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2009.02.17.dfsg.3-2","2009.02.17.dfsg.3-3"]},{"source":"osv","ecosystem":"Ubuntu:Pro:24.04:LTS","package":"emacs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1:29.1+1-5ubuntu1","1:29.2+1-1ubuntu1","1:29.2+1-2ubuntu4","1:29.3+1-1ubuntu2","1:29.3+1-1ubuntu2+esm1","1:29.3+1-1ubuntu2+esm3","1:29.3+1-1ubuntu2+esm4"]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"emacs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1:30.2+1-2ubuntu1","1:30.2+1-6ubuntu1","1:30.2+1-11ubuntu1"]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"xemacs21","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["21.4.24-12build3"]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"xemacs21-packages","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2009.02.17.dfsg.3-3build1"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"xemacs21","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["21.4.24-12build3"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"xemacs21-packages","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2009.02.17.dfsg.3-3","2009.02.17.dfsg.3-3build1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:26.04:LTS","package":"emacs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1:30.1+1-9ubuntu1","1:30.2+1-1ubuntu2","1:30.2+1-2ubuntu1","1:30.2+1-2ubuntu1+esm1"]},{"source":"osv","ecosystem":"openSUSE:Leap 16.0","package":"emacs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"30.2-160000.3.1"}]}],"bundled":2}],"products":[{"vendor":"gnu","product":"emacs"},{"vendor":"microsoft","product":"emacs"}],"references":[{"url":"https://debbugs.gnu.org/cgi/bugreport.cgi?bug=81344","tags":["issue-tracking","report","article"]},{"url":"https://github.com/emacs-mirror/emacs/releases/tag/emacs-31.0.91","tags":["release-notes","advisory","article"]},{"url":"https://github.com/emacs-mirror/emacs/commit/b07e634e4cf45162ae0178e32092b040587f2c6c","tags":["patch","fix","article"]},{"url":"https://www.vulncheck.com/advisories/gnu-emacs-heap-over-read-via-pbm-ppm-pgm-image-loader","tags":["third-party-advisory","advisory","article"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-77219","tags":["web","advisory"]},{"url":"https://github.com/advisories/GHSA-q8pr-2495-3jw7"},{"url":"https://access.redhat.com/errata/RHSA-2026:80506","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-77219","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-79992","tags":["report"]},{"url":"https://bugzilla.redhat.com/2521196","tags":["report"]},{"url":"https://bugzilla.redhat.com/2523665","tags":["report"]},{"url":"https://errata.almalinux.org/8/ALSA-2026-80506.html","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:80507","tags":["advisory"]},{"url":"https://errata.almalinux.org/9/ALSA-2026-80507.html","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:84591","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-96442","tags":["report"]},{"url":"https://bugzilla.redhat.com/2537347","tags":["report"]},{"url":"https://errata.almalinux.org/10/ALSA-2026-84591.html","tags":["advisory"]},{"url":"https://errata.tuxcare.com/els_os/almalinux9.2esu/CLSA-2026-1792080478.html","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-108976","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-79992","tags":["advisory"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/77xxx/CVE-2026-77219.json","tags":["advisory"]},{"url":"https://github.com/emacs-mirror/emacs","tags":["package"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2026-77219","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-4083","tags":["advisory"]},{"url":"https://access.redhat.com/security/updates/classification/#important","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2521196","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2523665","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_80506.json","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-77219","tags":["advisory","report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-79992","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_80507.json","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2537347","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_84591.json","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-96442","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-96442","tags":["advisory"]},{"url":"https://github.com/emacs-mirror/emacs/commit/135e6f63f08fee3d374fa1a5187bce941a2d3e3c","tags":["article"]},{"url":"https://github.com/emacs-mirror/emacs/commit/abc802ee2eb0b1663349ddf22a461f8e54a383fb","tags":["article"]},{"url":"https://www.openwall.com/lists/oss-security/2026/09/14/1","tags":["article"]},{"url":"https://errata.rockylinux.org/RLSA-2026:80506","tags":["advisory"]},{"url":"https://errata.rockylinux.org/RLSA-2026:80507","tags":["advisory"]},{"url":"https://errata.rockylinux.org/RLSA-2026:84591","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-202623589-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1271643","tags":["report"]},{"url":"https://bugzilla.suse.com/1275927","tags":["report"]},{"url":"https://bugzilla.suse.com/1275941","tags":["report"]},{"url":"https://bugzilla.suse.com/1276264","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2026-77219","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-79992","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20263993-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20264083-1/","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2026-77219","tags":["report"]},{"url":"","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2026-77219","title":"GNU Emacs \u003c 31.0.91 Heap Over-Read via PBM/PPM/PGM Image Loader","description":"GNU Emacs before 31.0.91 contains an integer overflow in the PBM/PPM/PGM image loader that allows an attacker to leak heap memory contents by supplying a crafted image with large dimensions and an elevated max color index. The image loader multiplies image dimensions and channel count using signed integer arithmetic; for sufficiently large values, the result wraps to a negative number, bypassing the bounds check and causing the pixel reader to access heap memory past the end of the allocated buffer. The over-read contents are interpreted as pixel color values and rendered on screen.","status":"published","published":"2026-08-21T20:20:45.314Z","modified":"2026-11-08T14:08:55.414Z","cvss":[{"version":"4.0","score":6.9,"vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:N/VA:H/SC:N/SI:N/SA:N","level":"medium","assessor":"cna"},{"version":"3.1","score":7.1,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:H","level":"high","assessor":"cna"}],"cwes":["CWE-190","CWE-125"],"updated_at":"2026-11-08T15:43:34.234229Z"}],"euvd":[{"id":"EUVD-2026-64138","description":"GNU Emacs before 31.0.91 contains an integer overflow in the PBM/PPM/PGM image loader that allows an attacker to leak heap memory contents by supplying a crafted image with large dimensions and an elevated max color index. The image loader multiplies image dimensions and channel count using signed integer arithmetic; for sufficiently large values, the result wraps to a negative number, bypassing the bounds check and causing the pixel reader to access heap memory past the end of the allocated buffer. The over-read contents are interpreted as pixel color values and rendered on screen.","status":"published","published":"2026-08-21T20:20:45Z","modified":"2026-11-08T14:08:55Z","cvss":[{"version":"4.0","score":6.9,"vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:N/VA:H/SC:N/SI:N/SA:N","level":"medium"}],"updated_at":"2026-11-08T15:13:06.469155Z"}],"ghsa":[{"id":"GHSA-q8pr-2495-3jw7","title":"GNU Emacs before 31.0.91 contains an integer overflow in the PBM/PPM/PGM image loader that allows...","description":"GNU Emacs before 31.0.91 contains an integer overflow in the PBM/PPM/PGM image loader that allows an attacker to leak heap memory contents by supplying a crafted image with large dimensions and an elevated max color index. The image loader multiplies image dimensions and channel count using signed integer arithmetic; for sufficiently large values, the result wraps to a negative number, bypassing the bounds check and causing the pixel reader to access heap memory past the end of the allocated buffer. The over-read contents are interpreted as pixel color values and rendered on screen.","status":"published","published":"2026-08-21T21:31:52Z","modified":"2026-08-21T21:31:59Z","cvss":[{"version":"4.0","score":6.9,"vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"medium"},{"version":"3.1","score":7.1,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:H","level":"high"}],"cwes":["CWE-125"],"updated_at":"2026-11-02T15:10:50.012908Z"}],"nvd":[{"id":"CVE-2026-77219","description":"GNU Emacs before 31.0.91 contains an integer overflow in the PBM/PPM/PGM image loader that allows an attacker to leak heap memory contents by supplying a crafted image with large dimensions and an elevated max color index. The image loader multiplies image dimensions and channel count using signed integer arithmetic; for sufficiently large values, the result wraps to a negative number, bypassing the bounds check and causing the pixel reader to access heap memory past the end of the allocated buffer. The over-read contents are interpreted as pixel color values and rendered on screen.","status":"published","published":"2026-08-21T21:17:06.59Z","modified":"2026-10-12T16:10:00.22Z","cvss":[{"version":"4.0","score":6.9,"vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"medium","assessor":"secondary"},{"version":"3.1","score":7.1,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:H","level":"high","assessor":"secondary"}],"cwes":["CWE-125","CWE-190"],"updated_at":"2026-11-02T14:12:40.665005Z"}],"osv":[{"id":"CVE-2026-77219","title":"GNU Emacs \u003c 31.0.91 Heap Over-Read via PBM/PPM/PGM Image Loader","description":"GNU Emacs before 31.0.91 contains an integer overflow in the PBM/PPM/PGM image loader that allows an attacker to leak heap memory contents by supplying a crafted image with large dimensions and an elevated max color index. The image loader multiplies image dimensions and channel count using signed integer arithmetic; for sufficiently large values, the result wraps to a negative number, bypassing the bounds check and causing the pixel reader to access heap memory past the end of the allocated buffer. The over-read contents are interpreted as pixel color values and rendered on screen.","status":"published","published":"2026-08-21T20:20:45.314Z","modified":"2026-11-09T07:13:39.67161205Z","cvss":[{"version":"4.0","score":6.9,"vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:N/VA:H/SC:N/SI:N/SA:N","level":"medium"}],"cwes":["CWE-125","CWE-190"],"updated_at":"2026-11-09T03:15:52.404586Z"},{"id":"DEBIAN-CVE-2026-77219","description":"GNU Emacs before 31.0.91 contains an integer overflow in the PBM/PPM/PGM image loader that allows an attacker to leak heap memory contents by supplying a crafted image with large dimensions and an elevated max color index. The image loader multiplies image dimensions and channel count using signed integer arithmetic; for sufficiently large values, the result wraps to a negative number, bypassing the bounds check and causing the pixel reader to access heap memory past the end of the allocated buffer. The over-read contents are interpreted as pixel color values and rendered on screen.","status":"published","published":"2026-08-21T21:17:06.59Z","modified":"2026-10-13T09:47:37.602497783Z","cvss":[{"version":"4.0","score":6.9,"vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"medium"}],"updated_at":"2026-11-02T15:46:03.502256Z"},{"id":"OESA-2026-4083","title":"emacs security update","description":"Emacs is the extensible, customizable, self-documenting real-time display editor. At its core is an interpreter for Emacs Lisp, a dialect of the Lisp programming language with extensions to support text editing. And it is an entire ecosystem of functionality beyond text editing, including a project planner, mail and news reader, debugger interface, calendar, and more.\r\n\r\nSecurity Fix(es):\n\nGNU Emacs before 31.0.91 contains an integer overflow in the PBM/PPM/PGM image loader that allows an attacker to leak heap memory contents by supplying a crafted image with large dimensions and an elevated max color index. The image loader multiplies image dimensions and channel count using signed integer arithmetic; for sufficiently large values, the result wraps to a negative number, bypassing the bounds check and causing the pixel reader to access heap memory past the end of the allocated buffer. The over-read contents are interpreted as pixel color values and rendered on screen.(CVE-2026-77219)","status":"published","published":"2026-09-25T01:28:13Z","modified":"2026-09-25T01:45:10.352237642Z","cvss":[{"version":"4.0","score":6.9,"vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:N/VA:H/SC:N/SI:N/SA:N","level":"medium"}],"updated_at":"2026-11-02T15:52:47.643553Z"},{"id":"RHSA-2026:80506","title":"Red Hat Security Advisory: emacs security update","status":"published","published":"2026-10-14T10:31:45Z","modified":"2026-10-20T10:16:28Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:23.547034Z"},{"id":"RHSA-2026:80507","title":"Red Hat Security Advisory: emacs security update","status":"published","published":"2026-10-14T10:31:46Z","modified":"2026-10-20T10:16:29Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:23.547034Z"},{"id":"RHSA-2026:84591","title":"Red Hat Security Advisory: emacs security update","status":"published","published":"2026-10-19T10:08:05Z","modified":"2026-10-20T10:17:40Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:23.547034Z"},{"id":"RLSA-2026:80506","title":"Important: emacs security update","description":"GNU Emacs is a powerful, customizable, self-documenting text editor. It provides special code editing features, a scripting language (elisp), and the capability to read e-mail and news.\n\nSecurity Fix(es):\n\n* emacs: GNU Emacs: Heap over-read leading to information disclosure via crafted image (CVE-2026-77219)\n\n* emacs: local shell command injection through the user field in emacs tramp (CVE-2026-79992)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.","status":"published","published":"2026-10-13T12:00:56.225358Z","modified":"2026-10-13T12:30:02.888696799Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:26.449929Z"},{"id":"RLSA-2026:80507","title":"Important: emacs security update","description":"GNU Emacs is a powerful, customizable, self-documenting text editor. It provides special code editing features, a scripting language (elisp), and the capability to read e-mail and news.\n\nSecurity Fix(es):\n\n* emacs: GNU Emacs: Heap over-read leading to information disclosure via crafted image (CVE-2026-77219)\n\n* emacs: local shell command injection through the user field in emacs tramp (CVE-2026-79992)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.","status":"published","published":"2026-10-13T12:04:29.039883Z","modified":"2026-10-13T12:30:02.880678914Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:26.449929Z"},{"id":"RLSA-2026:84591","title":"Important: emacs security update","description":"GNU Emacs is a powerful, customizable, self-documenting text editor. It provides special code editing features, a scripting language (elisp), and the capability to read e-mail and news.\n\nSecurity Fix(es):\n\n* emacs: GNU Emacs: Heap over-read leading to information disclosure via crafted image (CVE-2026-77219)\n\n* emacs: emacs: Command injection via crafted filenames in TRAMP (CVE-2026-79992)\n\n* emacs: Emacs: arbitrary code execution in Flymake mode (CVE-2026-96442)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.","status":"published","published":"2026-10-20T12:10:14.939262Z","modified":"2026-10-20T12:15:37.45210559Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:26.76659Z"},{"id":"UBUNTU-CVE-2026-77219","description":"GNU Emacs before 31.0.91 contains an integer overflow in the PBM/PPM/PGM image loader that allows an attacker to leak heap memory contents by supplying a crafted image with large dimensions and an elevated max color index. The image loader multiplies image dimensions and channel count using signed integer arithmetic; for sufficiently large values, the result wraps to a negative number, bypassing the bounds check and causing the pixel reader to access heap memory past the end of the allocated buffer. The over-read contents are interpreted as pixel color values and rendered on screen.","status":"published","published":"2026-08-21T21:17:00Z","modified":"2026-10-17T13:01:08.318648792Z","cvss":[{"version":"3.1","score":7.1,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:H","level":"high"},{"version":"4.0","score":6.9,"vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:N/VA:H/SC:N/SI:N/SA:N","level":"medium"}],"updated_at":"2026-11-02T16:57:13.483205Z"},{"id":"ALSA-2026:80506","title":"Important: emacs security update","description":"GNU Emacs is a powerful, customizable, self-documenting text editor. It provides special code editing features, a scripting language (elisp), and the capability to read e-mail and news.  \n\nSecurity Fix(es):  \n\n  * emacs: GNU Emacs: Heap over-read leading to information disclosure via crafted image (CVE-2026-77219)\n  * emacs: local shell command injection through the user field in emacs tramp (CVE-2026-79992)\n\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n","status":"published","published":"2026-10-12T00:00:00Z","modified":"2026-10-29T11:02:29.659824738Z","updated_at":"2026-11-02T15:27:55.200553Z"},{"id":"ALSA-2026:80507","title":"Important: emacs security update","description":"GNU Emacs is a powerful, customizable, self-documenting text editor. It provides special code editing features, a scripting language (elisp), and the capability to read e-mail and news.  \n\nSecurity Fix(es):  \n\n  * emacs: GNU Emacs: Heap over-read leading to information disclosure via crafted image (CVE-2026-77219)\n  * emacs: local shell command injection through the user field in emacs tramp (CVE-2026-79992)\n\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n","status":"published","published":"2026-10-12T00:00:00Z","modified":"2026-10-29T11:32:38.050657987Z","updated_at":"2026-11-02T15:27:55.200553Z"},{"id":"ALSA-2026:84591","title":"Important: emacs security update","description":"GNU Emacs is a powerful, customizable, self-documenting text editor. It provides special code editing features, a scripting language (elisp), and the capability to read e-mail and news.  \n\nSecurity Fix(es):  \n\n  * emacs: GNU Emacs: Heap over-read leading to information disclosure via crafted image (CVE-2026-77219)\n  * emacs: emacs: Command injection via crafted filenames in TRAMP (CVE-2026-79992)\n  * emacs: Emacs: arbitrary code execution in Flymake mode (CVE-2026-96442)\n\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n","status":"published","published":"2026-10-19T00:00:00Z","modified":"2026-10-29T11:31:02.015329626Z","updated_at":"2026-11-02T15:27:55.200553Z"},{"id":"AZL-96986","title":"CVE-2026-77219 affecting package emacs for versions less than 29.4-6","description":"GNU Emacs before 31.0.91 contains an integer overflow in the PBM/PPM/PGM image loader that allows an attacker to leak heap memory contents by supplying a crafted image with large dimensions and an elevated max color index. The image loader multiplies image dimensions and channel count using signed integer arithmetic; for sufficiently large values, the result wraps to a negative number, bypassing the bounds check and causing the pixel reader to access heap memory past the end of the allocated buffer. The over-read contents are interpreted as pixel color values and rendered on screen.","status":"published","published":"2026-08-21T21:17:06Z","modified":"2026-11-05T05:40:51Z","updated_at":"2026-11-05T16:41:26.280152Z"},{"id":"CLSA-2026-1792080478","title":"emacs: Fix of 3 CVEs","description":"- CVE-2026-77219: fix integer overflow in PBM image loader\n- CVE-2026-79992: restrict Tramp user names to prevent shell command injection\n- CVE-2026-108976: strengthen Tramp user and host name validation","status":"published","published":"2026-10-15T16:08:10Z","modified":"2026-10-26T09:43:42.652054373Z","updated_at":"2026-11-02T15:43:50.949147Z"},{"id":"openSUSE-SU-2026:21711-1","title":"Security update for emacs","description":"This update for emacs fixes the following issues:\n\nSecurity issues fixed:\n\n- Arbitrary code execution when opening a specially crafted file (bsc#1275941).\n- CVE-2026-77219: integer overflow in the PBM/PPM/PGM image loader leads to heap memory content leaks when a crafted\n  image with large dimensions and an elevated max color index is processed (bsc#1276264).\n- CVE-2026-79992: improper argument sanitization in TRAMP leads to arbitrary code execution via crafted filenames\n  (bsc#1275927).\n\nOther updates and bugfixes:\n\n- Fix memory leak in wayland port (bsc#1271643).\n","status":"published","published":"2026-08-31T11:49:39Z","modified":"2026-09-02T18:23:08.723462041Z","updated_at":"2026-11-02T16:58:42.426393Z"},{"id":"SUSE-SU-2026:23589-1","title":"Security update for emacs","description":"This update for emacs fixes the following issues:\n\nSecurity issues fixed:\n\n- Arbitrary code execution when opening a specially crafted file (bsc#1275941).\n- CVE-2026-77219: integer overflow in the PBM/PPM/PGM image loader leads to heap memory content leaks when a crafted\n  image with large dimensions and an elevated max color index is processed (bsc#1276264).\n- CVE-2026-79992: improper argument sanitization in TRAMP leads to arbitrary code execution via crafted filenames\n  (bsc#1275927).\n\nOther updates and bugfixes:\n\n- Fix memory leak in wayland port (bsc#1271643).\n","status":"published","published":"2026-08-31T12:20:18Z","modified":"2026-09-29T18:23:18.705958394Z","updated_at":"2026-11-02T15:54:03.991985Z"},{"id":"SUSE-SU-2026:3993-1","title":"Security update for emacs","description":"This update for emacs fixes the following issues:\n\n- code execution upon opening arbitrary file (bsc#1275941).\n- CVE-2026-77219: memory leak via the PBM/PPM/PGM image loader (bsc#1276264).\n- CVE-2026-79992: zero-click local command execution via TRAMP (bsc#1275927).\n","status":"published","published":"2026-09-07T07:21:45Z","modified":"2026-09-13T18:23:13.561206942Z","updated_at":"2026-11-02T15:54:05.392906Z"},{"id":"SUSE-SU-2026:4083-1","title":"Security update for emacs","description":"This update for emacs fixes the following issues:\n\n- Arbitrary code execution when opening a specially crafted file (bsc#1275941).\n- CVE-2026-77219: integer overflow in the PBM/PPM/PGM image loader leads to heap memory content leaks when a crafted\n  image with large dimensions and an elevated max color index is processed (bsc#1276264).\n- CVE-2026-79992: improper argument sanitization in TRAMP leads to arbitrary code execution via crafted filenames\n  (bsc#1275927).\n","status":"published","published":"2026-09-08T09:56:20Z","modified":"2026-09-13T18:23:21.682598622Z","updated_at":"2026-11-02T15:54:05.392906Z"}]}}