Gnu Emacs vulnerabilities

• gnu emacs GNU Emacs before 31.2 (and TRAMP through 2.8.2) allows OS command injection via a filename... CVE-2026-108976 Fix available 7.8 HighOctober 11, 2026
• gnu emacs GNU Emacs 28.1 through 31.1 allows arbitrary code execution upon opening a file, because an... CVE-2026-96269 Fix available 7.5 HighSeptember 22, 2026
• gnu emacs GNU Emacs < 31.0.91 Heap Over-Read via PBM/PPM/PGM Image Loader CVE-2026-77219 Fix available 6.9 MediumAugust 21, 2026
• gnu emacs Heap Use of Uninitialized Memory in GNU Emacs for Android CVE-2026-71394 5.3 MediumAugust 10, 2026
• gnu emacs Heap Buffer Overflow in GNU Emacs for Android CVE-2026-71393 5.3 MediumAugust 10, 2026
• gnu emacs Integer Overflow in GNU Emacs for Android CVE-2026-71392 5.3 MediumAugust 10, 2026
• gnu emacs Off-by-One Error in GNU Emacs for Android CVE-2026-71391 5.3 MediumAugust 10, 2026
• gnu emacs, red hat enterprise linux 10, enterprise linux 6 +3 more +5 more Emacs: emacs: memory corruption vulnerability when processing svg css CVE-2026-6861 Fix available 6.1 MediumApril 22, 2026
• gnu emacs In elisp-mode.el in GNU Emacs through 30.0.92, a user who chooses to invoke elisp-completion-at... CVE-2024-53920 Fix available 7.8 HighNovember 27, 2024
• gnu emacs In Emacs before 29.4, org-link-expand-abbrev in lisp/ol.el expands a %(...) link abbrev even when... CVE-2024-39331 Fix available 9.8 CriticalJune 23, 2024
• gnu emacs, org mode, debian linux +2 more In Emacs before 29.3, Org mode considers contents of remote files to be trusted. This affects Org... CVE-2024-30205 Fix available 7.1 HighMarch 25, 2024
• gnu emacs, debian linux, gnu org mode +2 more In Emacs before 29.3, LaTeX preview is enabled by default for e-mail attachments. CVE-2024-30204 Fix available 2.8 LowMarch 25, 2024
• gnu emacs, debian linux, gnu org mode +2 more In Emacs before 29.3, Gnus treats inline MIME contents as trusted. CVE-2024-30203 Fix available 5.5 MediumMarch 25, 2024
• gnu emacs, org mode +1 more In Emacs before 29.3, arbitrary Lisp code is evaluated as part of turning on Org mode. This... CVE-2024-30202 Fix available 7.8 HighMarch 25, 2024
• gnu emacs, redhat enterprise linux, enterprise linux eus +2 more +4 more A flaw was found in the Emacs text editor. Processing a specially crafted org-mode code with the ... CVE-2023-2491 Fix available 7.8 HighMay 9, 2023
• gnu emacs emacsclient-mail.desktop in Emacs 28.1 through 28.2 is vulnerable to Emacs Lisp code injections... CVE-2023-27986 Fix available 7.8 HighMarch 9, 2023
• gnu emacs emacsclient-mail.desktop in Emacs 28.1 through 28.2 is vulnerable to shell command injections... CVE-2023-27985 Fix available 7.8 HighMarch 9, 2023
• gnu emacs An issue was discovered in GNU Emacs through 28.2. htmlfontify.el has a command injection... CVE-2022-48339 Fix available 7.8 HighFebruary 20, 2023
• gnu emacs An issue was discovered in GNU Emacs through 28.2. In ruby-mode.el, the ruby-find-library-file... CVE-2022-48338 Fix available 7.3 HighFebruary 20, 2023
• gnu emacs, debian linux +1 more GNU Emacs through 28.2 allows attackers to execute commands via shell metacharacters in the name... CVE-2022-48337 Fix available 9.8 CriticalFebruary 20, 2023
• gnu emacs, debian linux, fedoraproject fedora +2 more GNU Emacs through 28.2 allows attackers to execute commands via shell metacharacters in the name... CVE-2022-45939 Fix available 7.8 HighNovember 28, 2022
• gnu emacs GNU Emacs version 25.3.1 (and other versions most likely) ignores umask when creating a backup... CVE-2017-1000383 5.5 MediumOctober 31, 2017
• gnu emacs, debian linux +1 more GNU Emacs before 25.3 allows remote attackers to execute arbitrary code via email with crafted ... CVE-2017-14482 Fix available 8.8 HighSeptember 12, 2017
• gnu emacs Emacs 24.4 allows remote attackers to bypass security restrictions. CVE-2014-9483 7.5 HighAugust 28, 2017
• gnu emacs, mageia project mageia +1 more lisp/net/tramp-sh.el in GNU Emacs 24.3 and earlier allows local users to overwrite arbitrary... CVE-2014-3424 3.3 LowMay 8, 2014
• gnu emacs, mageia project mageia +1 more lisp/net/browse-url.el in GNU Emacs 24.3 and earlier allows local users to overwrite arbitrary... CVE-2014-3423 3.3 LowMay 8, 2014
• gnu emacs, mageia project mageia +1 more lisp/emacs-lisp/find-gc.el in GNU Emacs 24.3 and earlier allows local users to overwrite... CVE-2014-3422 3.3 LowMay 8, 2014
• gnu emacs, mageia project mageia +1 more lisp/gnus/gnus-fun.el in GNU Emacs 24.3 and earlier allows local users to overwrite arbitrary... CVE-2014-3421 3.3 LowMay 8, 2014
• gnu emacs lisp/files.el in Emacs 23.2, 23.3, 23.4, and 24.1 automatically executes eval forms in local... CVE-2012-3479 Fix available 6.8 MediumAugust 25, 2012
• eric m ludlam cedet, gnu emacs +1 more Untrusted search path vulnerability in EDE in CEDET before 1.0.1, as used in GNU Emacs before 23... CVE-2012-0035 9.3 HighJanuary 19, 2012
• gnu emacs lib-src/movemail.c in movemail in emacs 22 and 23 allows local users to read, modify, or delete... CVE-2010-0825 Fix available 4.4 MediumApril 5, 2010
• gnu emacs, xemacs +1 more Emacs 21 and XEmacs automatically load and execute .flc (fast lock) files that are associated... CVE-2008-2142 Fix available 6.8 MediumMay 12, 2008
• gnu emacs, sccs +1 more vcdiff in Emacs 20.7 to 22.1.50, when used with SCCS, allows local users to overwrite arbitrary... CVE-2008-1694 Fix available 4.6 MediumApril 21, 2008
• gnu emacs Stack-based buffer overflow in emacs allows user-assisted attackers to cause a denial of service ... CVE-2007-6109 Fix available 10.0 HighDecember 7, 2007
• gnu emacs The hack-local-variables function in Emacs before 22.2, when enable-local-variables is set to ... CVE-2007-5795 Public exploitFix available 6.3 MediumNovember 2, 2007
• gnu emacs, debian linux +1 more Emacs 21 allows user-assisted attackers to cause a denial of service (crash) via certain crafted... CVE-2007-2833 Fix available 7.8 HighJune 21, 2007
• gnu emacs, xemacs +1 more Format string vulnerability in the movemail utility in (1) Emacs 20.x, 21.3, and possibly other... CVE-2005-0100 Fix available 7.5 HighFebruary 7, 2005
• gnu emacs Emacs 21.2.1 does not prompt or warn the user before executing Lisp code in the local variables... CVE-2003-1232 Public exploit 5.1 MediumDecember 31, 2003
• gnu emacs, xemacs +1 more rcs2log, as used in Emacs 20.4, xemacs 21.1.10 and other versions before 21.4, and possibly other... CVE-2001-1301 1.2 LowAugust 7, 2001
• gnu emacs read-passwd and other Lisp functions in Emacs 20 do not properly clear the history of recently... CVE-2000-0271 4.6 MediumApril 18, 2000
• gnu emacs The make-temp-name Lisp function in Emacs 20 creates temporary files with predictable names,... CVE-2000-0270 3.6 LowApril 18, 2000
• gnu emacs Emacs 20 does not properly set permissions for a slave PTY device when starting a new subprocess,... CVE-2000-0269 2.1 LowApril 18, 2000