{"id":"CVE-2026-79992","aliases":["ALSA-2026:80506","ALSA-2026:80507","ALSA-2026:84591","AZL-98195","CLSA-2026-1792080478","CLSA-2026-1792478726","CLSA-2026-1792478956","CLSA-2026-1792623317","DEBIAN-CVE-2026-79992","EUVD-2026-65616","GHSA-42vv-cfp2-9qc8","OESA-2026-4404","OESA-2026-4405","OESA-2026-4407","RHSA-2026:80506","RHSA-2026:80507","RHSA-2026:84591","RLSA-2026:80506","RLSA-2026:80507","RLSA-2026:84591","SUSE-SU-2026:23589-1","SUSE-SU-2026:3993-1","SUSE-SU-2026:4083-1","SUSE-SU-2026:4893-1","UBUNTU-CVE-2026-79992","openSUSE-SU-2026:11637-1","openSUSE-SU-2026:21711-1"],"status":"published","title":"Emacs: emacs: command injection via crafted filenames in tramp","description":"A flaw was found in Emacs TRAMP. A local attacker could exploit this vulnerability by processing maliciously crafted filenames. This occurs because TRAMP concatenates login arguments without proper sanitization, which are then passed to a local shell. Successful exploitation could lead to arbitrary code execution.","severity":{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-12","score":0.00229,"percentile":0.13842,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-78"],"published":"2026-08-25T17:16:28Z","modified":"2026-11-11T12:53:50Z","fixes":[{"ecosystem":"Azure Linux:3","package":"emacs","fixed_in":["29.4-6"],"sources":["osv"]},{"ecosystem":"TuxCare:AlmaLinux:9.6","package":"emacs","fixed_in":["1:27.2-14.el9_6.2.tuxcare.els1"],"sources":["osv"]},{"ecosystem":"TuxCare:AlmaLinux:9.6","package":"emacs-common","fixed_in":["1:27.2-14.el9_6.2.tuxcare.els1"],"sources":["osv"]},{"ecosystem":"TuxCare:AlmaLinux:9.6","package":"emacs-devel","fixed_in":["1:27.2-14.el9_6.2.tuxcare.els1"],"sources":["osv"]},{"ecosystem":"TuxCare:AlmaLinux:9.6","package":"emacs-filesystem","fixed_in":["1:27.2-14.el9_6.2.tuxcare.els1"],"sources":["osv"]},{"ecosystem":"TuxCare:AlmaLinux:9.6","package":"emacs-lucid","fixed_in":["1:27.2-14.el9_6.2.tuxcare.els1"],"sources":["osv"]},{"ecosystem":"TuxCare:AlmaLinux:9.6","package":"emacs-nox","fixed_in":["1:27.2-14.el9_6.2.tuxcare.els1"],"sources":["osv"]},{"ecosystem":"TuxCare:AlmaLinux:9.6","package":"emacs-terminal","fixed_in":["1:27.2-14.el9_6.2.tuxcare.els1"],"sources":["osv"]},{"ecosystem":"openSUSE:Tumbleweed","package":"emacs","fixed_in":["31.1-1.1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"AlmaLinux:8","package":"emacs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:26.1-15.el8_10.2"}]}],"bundled":2},{"source":"osv","ecosystem":"AlmaLinux:8","package":"emacs-common","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:26.1-15.el8_10.2"}]}],"bundled":2},{"source":"osv","ecosystem":"AlmaLinux:8","package":"emacs-filesystem","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:26.1-15.el8_10.2"}]}],"bundled":2},{"source":"osv","ecosystem":"AlmaLinux:8","package":"emacs-lucid","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:26.1-15.el8_10.2"}]}],"bundled":2},{"source":"osv","ecosystem":"AlmaLinux:8","package":"emacs-nox","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:26.1-15.el8_10.2"}]}],"bundled":2},{"source":"osv","ecosystem":"AlmaLinux:8","package":"emacs-terminal","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:26.1-15.el8_10.2"}]}],"bundled":2},{"source":"osv","ecosystem":"AlmaLinux:9","package":"emacs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:27.2-18.el9_8.2"}]}],"bundled":2},{"source":"osv","ecosystem":"AlmaLinux:9","package":"emacs-common","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:27.2-18.el9_8.2"}]}],"bundled":2},{"source":"osv","ecosystem":"AlmaLinux:9","package":"emacs-filesystem","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:27.2-18.el9_8.2"}]}],"bundled":2},{"source":"osv","ecosystem":"AlmaLinux:9","package":"emacs-lucid","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:27.2-18.el9_8.2"}]}],"bundled":2},{"source":"osv","ecosystem":"AlmaLinux:9","package":"emacs-nox","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:27.2-18.el9_8.2"}]}],"bundled":2},{"source":"osv","ecosystem":"AlmaLinux:10","package":"emacs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:29.4-14.el10_2.3"}]}],"bundled":3},{"source":"osv","ecosystem":"AlmaLinux:10","package":"emacs-common","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:29.4-14.el10_2.3"}]}],"bundled":3},{"source":"osv","ecosystem":"AlmaLinux:10","package":"emacs-filesystem","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:29.4-14.el10_2.3"}]}],"bundled":3},{"source":"osv","ecosystem":"AlmaLinux:10","package":"emacs-lucid","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:29.4-14.el10_2.3"}]}],"bundled":3},{"source":"osv","ecosystem":"AlmaLinux:10","package":"emacs-nw","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:29.4-14.el10_2.3"}]}],"bundled":3},{"source":"osv","ecosystem":"Azure Linux:3","package":"emacs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"29.4-6"}]}]},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"emacs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:27.2-8.el9_2.1.tuxcare.els7"}]}],"bundled":3},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"emacs-common","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:27.2-8.el9_2.1.tuxcare.els7"}]}],"bundled":3},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"emacs-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:27.2-8.el9_2.1.tuxcare.els7"}]}],"bundled":3},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"emacs-filesystem","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:27.2-8.el9_2.1.tuxcare.els7"}]}],"bundled":3},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"emacs-lucid","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:27.2-8.el9_2.1.tuxcare.els7"}]}],"bundled":3},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"emacs-nox","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:27.2-8.el9_2.1.tuxcare.els7"}]}],"bundled":3},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"emacs-terminal","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:27.2-8.el9_2.1.tuxcare.els7"}]}],"bundled":3},{"source":"osv","ecosystem":"TuxCare:RHEL:7","package":"emacs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:24.3-23.0.1.el7_9.1.tuxcare.els3"}]}],"bundled":2},{"source":"osv","ecosystem":"TuxCare:RHEL:7","package":"emacs-common","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:24.3-23.0.1.el7_9.1.tuxcare.els3"}]}],"bundled":2},{"source":"osv","ecosystem":"TuxCare:RHEL:7","package":"emacs-el","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:24.3-23.0.1.el7_9.1.tuxcare.els3"}]}],"bundled":2},{"source":"osv","ecosystem":"TuxCare:RHEL:7","package":"emacs-filesystem","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:24.3-23.0.1.el7_9.1.tuxcare.els3"}]}],"bundled":2},{"source":"osv","ecosystem":"TuxCare:RHEL:7","package":"emacs-nox","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:24.3-23.0.1.el7_9.1.tuxcare.els3"}]}],"bundled":2},{"source":"osv","ecosystem":"TuxCare:RHEL:7","package":"emacs-terminal","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:24.3-23.0.1.el7_9.1.tuxcare.els3"}]}],"bundled":2},{"source":"osv","ecosystem":"TuxCare:OracleLinux:7","package":"emacs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:24.3-23.0.1.el7_9.1.tuxcare.els3"}]}],"bundled":2},{"source":"osv","ecosystem":"TuxCare:OracleLinux:7","package":"emacs-common","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:24.3-23.0.1.el7_9.1.tuxcare.els3"}]}],"bundled":2},{"source":"osv","ecosystem":"TuxCare:OracleLinux:7","package":"emacs-el","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:24.3-23.0.1.el7_9.1.tuxcare.els3"}]}],"bundled":2},{"source":"osv","ecosystem":"TuxCare:OracleLinux:7","package":"emacs-filesystem","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:24.3-23.0.1.el7_9.1.tuxcare.els3"}]}],"bundled":2},{"source":"osv","ecosystem":"TuxCare:OracleLinux:7","package":"emacs-nox","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:24.3-23.0.1.el7_9.1.tuxcare.els3"}]}],"bundled":2},{"source":"osv","ecosystem":"TuxCare:OracleLinux:7","package":"emacs-terminal","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:24.3-23.0.1.el7_9.1.tuxcare.els3"}]}],"bundled":2},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.6","package":"emacs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:27.2-14.el9_6.2.tuxcare.els1"}]}]},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.6","package":"emacs-common","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:27.2-14.el9_6.2.tuxcare.els1"}]}]},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.6","package":"emacs-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:27.2-14.el9_6.2.tuxcare.els1"}]}]},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.6","package":"emacs-filesystem","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:27.2-14.el9_6.2.tuxcare.els1"}]}]},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.6","package":"emacs-lucid","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:27.2-14.el9_6.2.tuxcare.els1"}]}]},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.6","package":"emacs-nox","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:27.2-14.el9_6.2.tuxcare.els1"}]}]},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.6","package":"emacs-terminal","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:27.2-14.el9_6.2.tuxcare.els1"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"emacs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1:28.2+1-15","1:28.2+1-15+deb12u1","1:28.2+1-15+deb12u2","1:28.2+1-15+deb12u3","1:28.2+1-15+deb12u4","1:28.2+1-16","1:29.1+1-1","1:29.1+1-2","1:29.1+1-3","1:29.1+1-4","1:29.1+1-5","1:29.1+1-5~bpo12+1","1:29.2+1-1","1:29.2+1-2","1:29.2+1-2~bpo12+1","1:29.3+1-1","1:29.3+1-2","1:29.3+1-2~bpo12+1","1:29.3+1-3","1:29.3+1-3~bpo12+1","1:29.4+1-1","1:29.4+1-2","1:29.4+1-2~bpo12+1","1:29.4+1-3","1:29.4+1-4","1:29.4+1-4~bpo12+1","1:29.4+1-5","1:29.4+1-6","1:29.4+1-6+alpha","1:30.1+1-1","1:30.1+1-2","1:30.1+1-3","1:30.1+1-3~bpo12+1","1:30.1+1-4","1:30.1+1-4~bpo12+1","1:30.1+1-5","1:30.1+1-5~bpo12+1","1:30.1+1-6","1:30.1+1-6~bpo12+1","1:30.1+1-7","1:30.1+1-8","1:30.1+1-9","1:30.2+1-1","1:30.2+1-10","1:30.2+1-11","1:30.2+1-2","1:30.2+1-3","1:30.2+1-4","1:30.2+1-5","1:30.2+1-6","1:30.2+1-7","1:30.2+1-8","1:30.2+1-9"]},{"source":"osv","ecosystem":"Debian:13","package":"emacs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1:30.1+1-6","1:30.1+1-6+deb13u1","1:30.1+1-7","1:30.1+1-8","1:30.1+1-9","1:30.2+1-1","1:30.2+1-10","1:30.2+1-11","1:30.2+1-2","1:30.2+1-3","1:30.2+1-4","1:30.2+1-5","1:30.2+1-6","1:30.2+1-7","1:30.2+1-8","1:30.2+1-9"]},{"source":"osv","ecosystem":"Debian:14","package":"emacs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1:30.1+1-6","1:30.1+1-7","1:30.1+1-8","1:30.1+1-9","1:30.2+1-1","1:30.2+1-10","1:30.2+1-11","1:30.2+1-2","1:30.2+1-3","1:30.2+1-4","1:30.2+1-5","1:30.2+1-6","1:30.2+1-7","1:30.2+1-8","1:30.2+1-9"]},{"source":"osv","ecosystem":"openEuler:24.03-LTS-SP3","package":"emacs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"29.1-10.oe2403sp3"}]}],"bundled":2},{"source":"osv","ecosystem":"openEuler:24.03-LTS-SP4","package":"emacs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"29.1-11.oe2403sp4"}]}],"bundled":2},{"source":"osv","ecosystem":"openEuler:24.03-LTS-SP1","package":"emacs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"29.1-10.oe2403sp1"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"emacs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:26.1-15.el8_10.2"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"emacs-common","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:26.1-15.el8_10.2"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"emacs-common-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:26.1-15.el8_10.2"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"emacs-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:26.1-15.el8_10.2"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"emacs-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:26.1-15.el8_10.2"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"emacs-lucid","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:26.1-15.el8_10.2"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"emacs-lucid-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:26.1-15.el8_10.2"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"emacs-nox","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:26.1-15.el8_10.2"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"emacs-nox-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:26.1-15.el8_10.2"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"emacs-terminal","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:26.1-15.el8_10.2"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::baseos","package":"emacs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:26.1-15.el8_10.2"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::baseos","package":"emacs-filesystem","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:26.1-15.el8_10.2"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"emacs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:27.2-18.el9_8.2"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"emacs-common","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:27.2-18.el9_8.2"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"emacs-common-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:27.2-18.el9_8.2"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"emacs-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:27.2-18.el9_8.2"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"emacs-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:27.2-18.el9_8.2"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"emacs-filesystem","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:27.2-18.el9_8.2"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"emacs-lucid","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:27.2-18.el9_8.2"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"emacs-lucid-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:27.2-18.el9_8.2"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"emacs-nox","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:27.2-18.el9_8.2"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"emacs-nox-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:27.2-18.el9_8.2"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"emacs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:29.4-14.el10_2.3"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"emacs-common","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:29.4-14.el10_2.3"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"emacs-common-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:29.4-14.el10_2.3"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"emacs-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:29.4-14.el10_2.3"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"emacs-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:29.4-14.el10_2.3"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"emacs-gtk+x11-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:29.4-14.el10_2.3"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"emacs-lucid","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:29.4-14.el10_2.3"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"emacs-lucid-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:29.4-14.el10_2.3"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"emacs-nw","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:29.4-14.el10_2.3"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"emacs-nw-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:29.4-14.el10_2.3"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"emacs-filesystem","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:29.4-14.el10_2.3"}]}],"bundled":3},{"source":"osv","ecosystem":"Rocky Linux:8","package":"emacs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:26.1-15.el8_10.2"}]}],"bundled":2},{"source":"osv","ecosystem":"Rocky Linux:9","package":"emacs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:27.2-18.el9_8.2"}]}],"bundled":2},{"source":"osv","ecosystem":"Rocky Linux:10","package":"emacs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:29.4-14.el10_2.3"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 16.0","package":"emacs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"30.2-160000.3.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP applications 16.0","package":"emacs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"30.2-160000.3.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP5-LTSS","package":"emacs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"24.3-25.26.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server LTSS Extended Security 12 SP5","package":"emacs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"24.3-25.26.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP7","package":"emacs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"27.2-150400.3.31.2"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Desktop Applications 15 SP7","package":"emacs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"27.2-150400.3.31.2"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS","package":"emacs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"27.2-150400.3.31.2"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS","package":"emacs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"27.2-150400.3.31.2"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP5-ESPOS","package":"emacs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"27.2-150400.3.31.2"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP5-LTSS","package":"emacs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"27.2-150400.3.31.2"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP4-LTSS","package":"emacs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"27.2-150400.3.31.2"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP5-LTSS","package":"emacs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"27.2-150400.3.31.2"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP6-LTSS","package":"emacs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"27.2-150400.3.31.2"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP4","package":"emacs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"27.2-150400.3.31.2"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP5","package":"emacs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"27.2-150400.3.31.2"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP6","package":"emacs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"27.2-150400.3.31.2"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP7","package":"emacs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"27.2-150400.3.37.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Desktop Applications 15 SP7","package":"emacs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"27.2-150400.3.37.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS","package":"emacs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"27.2-150400.3.37.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS","package":"emacs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"27.2-150400.3.37.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP5-ESPOS","package":"emacs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"27.2-150400.3.37.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP5-LTSS","package":"emacs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"27.2-150400.3.37.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP4-LTSS","package":"emacs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"27.2-150400.3.37.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP5-LTSS","package":"emacs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"27.2-150400.3.37.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP6-LTSS","package":"emacs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"27.2-150400.3.37.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP4","package":"emacs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"27.2-150400.3.37.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP5","package":"emacs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"27.2-150400.3.37.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP6","package":"emacs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"27.2-150400.3.37.1"}]}],"bundled":2},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"emacs24","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["24.5+1-1ubuntu2","24.5+1-1ubuntu4","24.5+1-1ubuntu5","24.5+1-1ubuntu6","24.5+1-1ubuntu7","24.5+1-6ubuntu1","24.5+1-6ubuntu1.1","24.5+1-6ubuntu1.1+esm1","24.5+1-6ubuntu1.1+esm2","24.5+1-6ubuntu1.1+esm3","24.5+1-6ubuntu1.1+esm4"]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"xemacs21","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["21.4.22-4ubuntu3","21.4.22-14ubuntu1"]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"xemacs21-packages","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2009.02.17.dfsg.2-2"]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"emacs25","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["25.2+1-6","25.2+1-6ubuntu0.1~esm2"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"xemacs21","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["21.4.24-4ubuntu1","21.4.24-5ubuntu1"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"xemacs21-packages","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2009.02.17.dfsg.2-4"]},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"emacs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1:26.3+1-1ubuntu1","1:26.3+1-1ubuntu2","1:26.3+1-1ubuntu2+esm1","1:26.3+1-1ubuntu2+esm2"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"xemacs21","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["21.4.24-8build1","21.4.24-9"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"xemacs21-packages","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2009.02.17.dfsg.2-4","2009.02.17.dfsg.2-5"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"xemacs21","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["21.4.24-9ubuntu2"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"xemacs21-packages","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2009.02.17.dfsg.2-5"]},{"source":"osv","ecosystem":"Ubuntu:Pro:22.04:LTS","package":"emacs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1:27.1+1-3ubuntu3","1:27.1+1-3ubuntu5","1:27.1+1-3ubuntu5.1","1:27.1+1-3ubuntu5.2","1:27.1+1-3ubuntu5.2+esm1"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"xemacs21","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["21.4.24-12","21.4.24-12build2","21.4.24-12build3"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"xemacs21-packages","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2009.02.17.dfsg.3-2","2009.02.17.dfsg.3-3"]},{"source":"osv","ecosystem":"Ubuntu:Pro:24.04:LTS","package":"emacs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1:29.1+1-5ubuntu1","1:29.2+1-1ubuntu1","1:29.2+1-2ubuntu4","1:29.3+1-1ubuntu2","1:29.3+1-1ubuntu2+esm1","1:29.3+1-1ubuntu2+esm3","1:29.3+1-1ubuntu2+esm4"]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"emacs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1:30.2+1-2ubuntu1","1:30.2+1-6ubuntu1","1:30.2+1-11ubuntu1"]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"xemacs21","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["21.4.24-12build3"]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"xemacs21-packages","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2009.02.17.dfsg.3-3build1"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"xemacs21","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["21.4.24-12build3"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"xemacs21-packages","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2009.02.17.dfsg.3-3","2009.02.17.dfsg.3-3build1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:26.04:LTS","package":"emacs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1:30.1+1-9ubuntu1","1:30.2+1-1ubuntu2","1:30.2+1-2ubuntu1","1:30.2+1-2ubuntu1+esm1"]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"emacs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"31.1-1.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Leap 16.0","package":"emacs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"30.2-160000.3.1"}]}],"bundled":2}],"products":[{"vendor":"red hat","product":"red hat enterprise linux 10"},{"vendor":"red hat","product":"red hat enterprise linux 6"},{"vendor":"red hat","product":"red hat enterprise linux 7"},{"vendor":"red hat","product":"red hat enterprise linux 8"},{"vendor":"red hat","product":"red hat enterprise linux 9"}],"references":[{"url":"https://access.redhat.com/errata/RHSA-2026:80506","tags":["vendor-advisory","x_refsource_REDHAT","advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:80507","tags":["vendor-advisory","x_refsource_REDHAT","advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:84591","tags":["vendor-advisory","x_refsource_REDHAT","advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:98574","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-79992","tags":["vdb-entry","x_refsource_REDHAT","report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2523665","tags":["issue-tracking","x_refsource_REDHAT","report"]},{"url":"http://www.openwall.com/lists/oss-security/2026/08/26/15"},{"url":"http://www.openwall.com/lists/oss-security/2026/10/11/1"},{"url":"http://www.openwall.com/lists/oss-security/2026/10/14/4"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-79992","tags":["web","advisory"]},{"url":"https://github.com/advisories/GHSA-42vv-cfp2-9qc8"},{"url":"https://access.redhat.com/security/cve/CVE-2026-77219","tags":["report"]},{"url":"https://bugzilla.redhat.com/2521196","tags":["report"]},{"url":"https://bugzilla.redhat.com/2523665","tags":["report"]},{"url":"https://errata.almalinux.org/8/ALSA-2026-80506.html","tags":["advisory"]},{"url":"https://errata.almalinux.org/9/ALSA-2026-80507.html","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-96442","tags":["report"]},{"url":"https://bugzilla.redhat.com/2537347","tags":["report"]},{"url":"https://errata.almalinux.org/10/ALSA-2026-84591.html","tags":["advisory"]},{"url":"https://errata.tuxcare.com/els_os/almalinux9.2esu/CLSA-2026-1792080478.html","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-108976","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-77219","tags":["advisory"]},{"url":"https://errata.tuxcare.com/els_os/rhel7els/CLSA-2026-1792478726.html","tags":["advisory"]},{"url":"https://errata.tuxcare.com/els_os/oraclelinux7els/CLSA-2026-1792478956.html","tags":["advisory"]},{"url":"https://errata.tuxcare.com/els_os/tuxcare9.6esu/CLSA-2026-1792623317.html","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2026-79992","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-4404","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-96442","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-4405","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-4407","tags":["advisory"]},{"url":"https://access.redhat.com/security/updates/classification/#important","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2521196","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_80506.json","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-77219","tags":["advisory"]},{"url":"https://debbugs.gnu.org/cgi/bugreport.cgi?bug=81344","tags":["article"]},{"url":"https://github.com/emacs-mirror/emacs/commit/b07e634e4cf45162ae0178e32092b040587f2c6c","tags":["article"]},{"url":"https://github.com/emacs-mirror/emacs/releases/tag/emacs-31.0.91","tags":["article"]},{"url":"https://www.vulncheck.com/advisories/gnu-emacs-heap-over-read-via-pbm-ppm-pgm-image-loader","tags":["article"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-79992","tags":["advisory","report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_80507.json","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2537347","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_84591.json","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-96442","tags":["advisory"]},{"url":"https://github.com/emacs-mirror/emacs/commit/135e6f63f08fee3d374fa1a5187bce941a2d3e3c","tags":["article"]},{"url":"https://github.com/emacs-mirror/emacs/commit/abc802ee2eb0b1663349ddf22a461f8e54a383fb","tags":["article"]},{"url":"https://www.openwall.com/lists/oss-security/2026/09/14/1","tags":["article"]},{"url":"https://errata.rockylinux.org/RLSA-2026:80506","tags":["advisory"]},{"url":"https://errata.rockylinux.org/RLSA-2026:80507","tags":["advisory"]},{"url":"https://errata.rockylinux.org/RLSA-2026:84591","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-202623589-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1271643","tags":["report"]},{"url":"https://bugzilla.suse.com/1275927","tags":["report"]},{"url":"https://bugzilla.suse.com/1275941","tags":["report"]},{"url":"https://bugzilla.suse.com/1276264","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2026-77219","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-79992","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20263993-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20264083-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20264893-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1284345","tags":["report"]},{"url":"https://bugzilla.suse.com/1284990","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2026-108976","tags":["web"]},{"url":"https://ubuntu.com/security/CVE-2026-79992","tags":["report"]},{"url":"https://www.openwall.com/lists/oss-security/2026/08/21/1","tags":["report"]},{"url":"","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2026-79992","title":"Emacs: emacs: command injection via crafted filenames in tramp","description":"A flaw was found in Emacs TRAMP. A local attacker could exploit this vulnerability by processing maliciously crafted filenames. This occurs because TRAMP concatenates login arguments without proper sanitization, which are then passed to a local shell. Successful exploitation could lead to arbitrary code execution.","status":"published","published":"2026-08-25T17:16:28.309Z","modified":"2026-11-11T12:53:50.949Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"cna"}],"cwes":["CWE-78"],"updated_at":"2026-11-11T13:28:05.136075Z"}],"euvd":[{"id":"EUVD-2026-65616","description":"A flaw was found in Emacs TRAMP. A local attacker could exploit this vulnerability by processing maliciously crafted filenames. This occurs because TRAMP concatenates login arguments without proper sanitization, which are then passed to a local shell. Successful exploitation could lead to arbitrary code execution.","status":"published","published":"2026-08-25T17:16:28Z","modified":"2026-11-11T12:53:50Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-11T14:28:59.314266Z"}],"ghsa":[{"id":"GHSA-42vv-cfp2-9qc8","title":"A flaw was found in Emacs TRAMP. A local attacker could exploit this vulnerability by processing...","description":"A flaw was found in Emacs TRAMP. A local attacker could exploit this vulnerability by processing maliciously crafted filenames. This occurs because TRAMP concatenates login arguments without proper sanitization, which are then passed to a local shell. Successful exploitation could lead to arbitrary code execution.","status":"published","published":"2026-08-25T18:32:01Z","modified":"2026-11-11T15:30:35Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-78"],"updated_at":"2026-11-11T15:34:47.187237Z"}],"nvd":[{"id":"CVE-2026-79992","description":"A flaw was found in Emacs TRAMP. A local attacker could exploit this vulnerability by processing maliciously crafted filenames. This occurs because TRAMP concatenates login arguments without proper sanitization, which are then passed to a local shell. Successful exploitation could lead to arbitrary code execution.","status":"published","published":"2026-08-25T18:18:06.973Z","modified":"2026-11-11T13:17:27.793Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"secondary"}],"cwes":["CWE-78"],"updated_at":"2026-11-11T15:25:14.7229Z"}],"osv":[{"id":"DEBIAN-CVE-2026-79992","description":"A flaw was found in Emacs TRAMP. A local attacker could exploit this vulnerability by processing maliciously crafted filenames. This occurs because TRAMP concatenates login arguments without proper sanitization, which are then passed to a local shell. Successful exploitation could lead to arbitrary code execution.","status":"published","published":"2026-08-25T18:18:06.973Z","modified":"2026-11-12T09:47:32.090589455Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-12T10:16:30.501395Z"},{"id":"OESA-2026-4404","title":"emacs security update","description":"Emacs is the extensible, customizable, self-documenting real-time display editor. At its core is an interpreter for Emacs Lisp, a dialect of the Lisp programming language with extensions to support text editing. And it is an entire ecosystem of functionality beyond text editing, including a project planner, mail and news reader, debugger interface, calendar, and more.\r\n\r\nSecurity Fix(es):\n\nA flaw was found in Emacs TRAMP. A local attacker could exploit this vulnerability by processing maliciously crafted filenames. This occurs because TRAMP concatenates login arguments without proper sanitization, which are then passed to a local shell. Successful exploitation could lead to arbitrary code execution.(CVE-2026-79992)\n\nA code execution flaw was found in Emacs, affecting versions prior to 31.2. The Flymake mode using language backends other than Lisp would execute arbitrary code from the edited file while performing syntax checking. Viewing or editing untrusted files using Emacs could lead to arbitrary code execution with the privileges of the user running Emacs.(CVE-2026-96442)","status":"published","published":"2026-10-16T12:00:14Z","modified":"2026-10-16T12:15:21.375050715Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:52:47.981622Z"},{"id":"OESA-2026-4405","title":"emacs security update","description":"Emacs is the extensible, customizable, self-documenting real-time display editor. At its core is an interpreter for Emacs Lisp, a dialect of the Lisp programming language with extensions to support text editing. And it is an entire ecosystem of functionality beyond text editing, including a project planner, mail and news reader, debugger interface, calendar, and more.\r\n\r\nSecurity Fix(es):\n\nA flaw was found in Emacs TRAMP. A local attacker could exploit this vulnerability by processing maliciously crafted filenames. This occurs because TRAMP concatenates login arguments without proper sanitization, which are then passed to a local shell. Successful exploitation could lead to arbitrary code execution.(CVE-2026-79992)\n\nA code execution flaw was found in Emacs, affecting versions prior to 31.2. The Flymake mode using language backends other than Lisp would execute arbitrary code from the edited file while performing syntax checking. Viewing or editing untrusted files using Emacs could lead to arbitrary code execution with the privileges of the user running Emacs.(CVE-2026-96442)","status":"published","published":"2026-10-16T12:00:14Z","modified":"2026-10-16T12:15:21.271829309Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:52:47.981622Z"},{"id":"OESA-2026-4407","title":"emacs security update","description":"Emacs is the extensible, customizable, self-documenting real-time display editor. At its core is an interpreter for Emacs Lisp, a dialect of the Lisp programming language with extensions to support text editing. And it is an entire ecosystem of functionality beyond text editing, including a project planner, mail and news reader, debugger interface, calendar, and more.\r\n\r\nSecurity Fix(es):\n\nA flaw was found in Emacs TRAMP. A local attacker could exploit this vulnerability by processing maliciously crafted filenames. This occurs because TRAMP concatenates login arguments without proper sanitization, which are then passed to a local shell. Successful exploitation could lead to arbitrary code execution.(CVE-2026-79992)\n\nA code execution flaw was found in Emacs, affecting versions prior to 31.2. The Flymake mode using language backends other than Lisp would execute arbitrary code from the edited file while performing syntax checking. Viewing or editing untrusted files using Emacs could lead to arbitrary code execution with the privileges of the user running Emacs.(CVE-2026-96442)","status":"published","published":"2026-10-16T12:00:16Z","modified":"2026-10-16T12:15:20.433104592Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:52:47.981622Z"},{"id":"RHSA-2026:80506","title":"Red Hat Security Advisory: emacs security update","status":"published","published":"2026-10-14T10:31:45Z","modified":"2026-10-20T10:16:28Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:23.547034Z"},{"id":"RHSA-2026:80507","title":"Red Hat Security Advisory: emacs security update","status":"published","published":"2026-10-14T10:31:46Z","modified":"2026-10-20T10:16:29Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:23.547034Z"},{"id":"RHSA-2026:84591","title":"Red Hat Security Advisory: emacs security update","status":"published","published":"2026-10-19T10:08:05Z","modified":"2026-10-20T10:17:40Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:23.547034Z"},{"id":"RLSA-2026:80506","title":"Important: emacs security update","description":"GNU Emacs is a powerful, customizable, self-documenting text editor. It provides special code editing features, a scripting language (elisp), and the capability to read e-mail and news.\n\nSecurity Fix(es):\n\n* emacs: GNU Emacs: Heap over-read leading to information disclosure via crafted image (CVE-2026-77219)\n\n* emacs: local shell command injection through the user field in emacs tramp (CVE-2026-79992)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.","status":"published","published":"2026-10-13T12:00:56.225358Z","modified":"2026-10-13T12:30:02.888696799Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:26.449929Z"},{"id":"RLSA-2026:80507","title":"Important: emacs security update","description":"GNU Emacs is a powerful, customizable, self-documenting text editor. It provides special code editing features, a scripting language (elisp), and the capability to read e-mail and news.\n\nSecurity Fix(es):\n\n* emacs: GNU Emacs: Heap over-read leading to information disclosure via crafted image (CVE-2026-77219)\n\n* emacs: local shell command injection through the user field in emacs tramp (CVE-2026-79992)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.","status":"published","published":"2026-10-13T12:04:29.039883Z","modified":"2026-10-13T12:30:02.880678914Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:26.449929Z"},{"id":"RLSA-2026:84591","title":"Important: emacs security update","description":"GNU Emacs is a powerful, customizable, self-documenting text editor. It provides special code editing features, a scripting language (elisp), and the capability to read e-mail and news.\n\nSecurity Fix(es):\n\n* emacs: GNU Emacs: Heap over-read leading to information disclosure via crafted image (CVE-2026-77219)\n\n* emacs: emacs: Command injection via crafted filenames in TRAMP (CVE-2026-79992)\n\n* emacs: Emacs: arbitrary code execution in Flymake mode (CVE-2026-96442)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.","status":"published","published":"2026-10-20T12:10:14.939262Z","modified":"2026-10-20T12:15:37.45210559Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:26.76659Z"},{"id":"UBUNTU-CVE-2026-79992","description":"A flaw was found in Emacs TRAMP. A local attacker could exploit this vulnerability by processing maliciously crafted filenames. This occurs because TRAMP concatenates login arguments without proper sanitization, which are then passed to a local shell. Successful exploitation could lead to arbitrary code execution.","status":"published","published":"2026-08-25T18:18:00Z","modified":"2026-10-17T13:01:10.089098746Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T16:57:18.015985Z"},{"id":"ALSA-2026:80506","title":"Important: emacs security update","description":"GNU Emacs is a powerful, customizable, self-documenting text editor. It provides special code editing features, a scripting language (elisp), and the capability to read e-mail and news.  \n\nSecurity Fix(es):  \n\n  * emacs: GNU Emacs: Heap over-read leading to information disclosure via crafted image (CVE-2026-77219)\n  * emacs: local shell command injection through the user field in emacs tramp (CVE-2026-79992)\n\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n","status":"published","published":"2026-10-12T00:00:00Z","modified":"2026-10-29T11:02:29.659824738Z","updated_at":"2026-11-02T15:27:55.200553Z"},{"id":"ALSA-2026:80507","title":"Important: emacs security update","description":"GNU Emacs is a powerful, customizable, self-documenting text editor. It provides special code editing features, a scripting language (elisp), and the capability to read e-mail and news.  \n\nSecurity Fix(es):  \n\n  * emacs: GNU Emacs: Heap over-read leading to information disclosure via crafted image (CVE-2026-77219)\n  * emacs: local shell command injection through the user field in emacs tramp (CVE-2026-79992)\n\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n","status":"published","published":"2026-10-12T00:00:00Z","modified":"2026-10-29T11:32:38.050657987Z","updated_at":"2026-11-02T15:27:55.200553Z"},{"id":"ALSA-2026:84591","title":"Important: emacs security update","description":"GNU Emacs is a powerful, customizable, self-documenting text editor. It provides special code editing features, a scripting language (elisp), and the capability to read e-mail and news.  \n\nSecurity Fix(es):  \n\n  * emacs: GNU Emacs: Heap over-read leading to information disclosure via crafted image (CVE-2026-77219)\n  * emacs: emacs: Command injection via crafted filenames in TRAMP (CVE-2026-79992)\n  * emacs: Emacs: arbitrary code execution in Flymake mode (CVE-2026-96442)\n\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n","status":"published","published":"2026-10-19T00:00:00Z","modified":"2026-10-29T11:31:02.015329626Z","updated_at":"2026-11-02T15:27:55.200553Z"},{"id":"AZL-98195","title":"CVE-2026-79992 affecting package emacs for versions less than 29.4-6","description":"A flaw was found in Emacs TRAMP. A local attacker could exploit this vulnerability by processing maliciously crafted filenames. This occurs because TRAMP concatenates login arguments without proper sanitization, which are then passed to a local shell. Successful exploitation could lead to arbitrary code execution.","status":"published","published":"2026-08-25T18:18:06Z","modified":"2026-11-05T05:40:51Z","updated_at":"2026-11-05T16:41:26.280152Z"},{"id":"CLSA-2026-1792080478","title":"emacs: Fix of 3 CVEs","description":"- CVE-2026-77219: fix integer overflow in PBM image loader\n- CVE-2026-79992: restrict Tramp user names to prevent shell command injection\n- CVE-2026-108976: strengthen Tramp user and host name validation","status":"published","published":"2026-10-15T16:08:10Z","modified":"2026-10-26T09:43:42.652054373Z","updated_at":"2026-11-02T15:43:50.949147Z"},{"id":"CLSA-2026-1792478726","title":"emacs: Fix of 2 CVEs","description":"- CVE-2026-108976: fix Tramp user and host name validation\n- CVE-2026-79992: strengthen Tramp user and host name limitations","status":"published","published":"2026-10-21T04:52:04Z","modified":"2026-10-26T09:31:59.290169588Z","updated_at":"2026-11-02T15:43:54.378946Z"},{"id":"CLSA-2026-1792478956","title":"emacs: Fix of 2 CVEs","description":"- CVE-2026-108976: fix Tramp user and host name validation\n- CVE-2026-79992: strengthen Tramp user and host name limitations","status":"published","published":"2026-10-21T04:53:46Z","modified":"2026-10-26T09:31:46.308437305Z","updated_at":"2026-11-02T15:43:54.378946Z"},{"id":"CLSA-2026-1792623317","title":"emacs: Fix of CVE-2026-79992","description":"- CVE-2026-79992: restrict Tramp user and host names","status":"published","published":"2026-10-21T22:55:25Z","modified":"2026-10-26T09:31:36.602543171Z","updated_at":"2026-11-02T15:43:54.672859Z"},{"id":"openSUSE-SU-2026:11637-1","title":"emacs-31.1-1.1 on GA media","description":"These are all security issues fixed in the emacs-31.1-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2026-08-29T00:00:00Z","modified":"2026-08-30T13:00:03.973901031Z","updated_at":"2026-11-02T16:58:39.516824Z"},{"id":"openSUSE-SU-2026:21711-1","title":"Security update for emacs","description":"This update for emacs fixes the following issues:\n\nSecurity issues fixed:\n\n- Arbitrary code execution when opening a specially crafted file (bsc#1275941).\n- CVE-2026-77219: integer overflow in the PBM/PPM/PGM image loader leads to heap memory content leaks when a crafted\n  image with large dimensions and an elevated max color index is processed (bsc#1276264).\n- CVE-2026-79992: improper argument sanitization in TRAMP leads to arbitrary code execution via crafted filenames\n  (bsc#1275927).\n\nOther updates and bugfixes:\n\n- Fix memory leak in wayland port (bsc#1271643).\n","status":"published","published":"2026-08-31T11:49:39Z","modified":"2026-09-02T18:23:08.723462041Z","updated_at":"2026-11-02T16:58:42.426393Z"},{"id":"SUSE-SU-2026:23589-1","title":"Security update for emacs","description":"This update for emacs fixes the following issues:\n\nSecurity issues fixed:\n\n- Arbitrary code execution when opening a specially crafted file (bsc#1275941).\n- CVE-2026-77219: integer overflow in the PBM/PPM/PGM image loader leads to heap memory content leaks when a crafted\n  image with large dimensions and an elevated max color index is processed (bsc#1276264).\n- CVE-2026-79992: improper argument sanitization in TRAMP leads to arbitrary code execution via crafted filenames\n  (bsc#1275927).\n\nOther updates and bugfixes:\n\n- Fix memory leak in wayland port (bsc#1271643).\n","status":"published","published":"2026-08-31T12:20:18Z","modified":"2026-09-29T18:23:18.705958394Z","updated_at":"2026-11-02T15:54:03.991985Z"},{"id":"SUSE-SU-2026:3993-1","title":"Security update for emacs","description":"This update for emacs fixes the following issues:\n\n- code execution upon opening arbitrary file (bsc#1275941).\n- CVE-2026-77219: memory leak via the PBM/PPM/PGM image loader (bsc#1276264).\n- CVE-2026-79992: zero-click local command execution via TRAMP (bsc#1275927).\n","status":"published","published":"2026-09-07T07:21:45Z","modified":"2026-09-13T18:23:13.561206942Z","updated_at":"2026-11-02T15:54:05.392906Z"},{"id":"SUSE-SU-2026:4083-1","title":"Security update for emacs","description":"This update for emacs fixes the following issues:\n\n- Arbitrary code execution when opening a specially crafted file (bsc#1275941).\n- CVE-2026-77219: integer overflow in the PBM/PPM/PGM image loader leads to heap memory content leaks when a crafted\n  image with large dimensions and an elevated max color index is processed (bsc#1276264).\n- CVE-2026-79992: improper argument sanitization in TRAMP leads to arbitrary code execution via crafted filenames\n  (bsc#1275927).\n","status":"published","published":"2026-09-08T09:56:20Z","modified":"2026-09-13T18:23:21.682598622Z","updated_at":"2026-11-02T15:54:05.392906Z"},{"id":"SUSE-SU-2026:4893-1","title":"Security update for emacs","description":"This update for emacs fixes the following issues:\n\n- CVE-2026-79992: zero-click local command execution via TRAMP (bsc#1275927).\n- CVE-2026-108976: flawed username input regex validation in TRAMP can cause arbitrary OS command injection\n  (bsc#1284345, bsc#1284990).\n","status":"published","published":"2026-10-23T10:50:19Z","modified":"2026-10-24T17:23:09.360807315Z","updated_at":"2026-11-02T15:54:05.838224Z"}]}}