CVE-2017-14482
HighSummary
GNU Emacs before 25.3 allows remote attackers to execute arbitrary code via email with crafted 'Content-Type: text/enriched' data. In particular, an Emacs user can be instantly compromised by reading a crafted email message.
Risk Assessment
This vulnerability poses a serious risk to Emacs users who may be infected with malicious code simply by opening a crafted email. This could lead to data loss or system compromise.
Recommendation
It is recommended to update GNU Emacs to version 25.3 or later to mitigate this vulnerability. Additionally, avoid opening emails from unknown senders.
Other vulnerabilities in GNU Emacs
See all- CVE-2026-77219High
GNU Emacs before 31.0.91 has an integer overflow in the PBM/PPM/PGM image loader. An attacker can supply a crafted image with large dimensions and an elevated max color index, leading to heap memory content leakage.
- CVE-2026-71394Medium
GNU Emacs for Android improperly validates table header input in sfnt_read_table_directory() in src/sfnt.c. Due to an incorrect comparison variable in the read-length check, a crafted font file can cause the parser to return a struct with uninitialized heap memory in table directory entries. This can lead to information disclosure, crashes, or arbitrary memory access on 32-bit targets.
- CVE-2026-71393Medium
GNU Emacs for Android is vulnerable to an integer overflow in sfnt_read_name_table() in src/sfnt.c. The function computes an allocation size using a 32-bit length value from a TrueType font file without overflow checking. On 32-bit targets, a crafted font causes the calculation to wrap, resulting in an undersized heap allocation and subsequent heap buffer overflow during read.
- CVE-2026-71392Medium
GNU Emacs for Android is vulnerable to an integer overflow in the sfnt_read_cmap_format_12() function in src/sfnt.c. When processing a crafted TrueType font file, an unguarded addition in the xmalloc allocation call wraps around on 32-bit builds, causing a heap buffer overflow write. This can lead to heap memory corruption and potential code execution.
- CVE-2026-71391Medium
GNU Emacs for Android contains an off-by-one error in the gvar table parser in src/sfnt.c. The shared-coordinate index boundary check in sfnt_vary_simple_glyph() and sfnt_vary_compound_glyph() uses a strict greater-than comparison instead of greater-than-or-equal, allowing a crafted TrueType variable font to bypass the check and trigger a heap-based out-of-bounds read via memcpy. This exposes heap memory contents which can be later used to defeat ASLR.
- CVE-2024-53920High
In elisp-mode.el in GNU Emacs before 30.1, invoking elisp-completion-at-point on untrusted Emacs Lisp source code can trigger unsafe Lisp macro expansion, allowing arbitrary code execution. This also occurs if on-the-fly byte compilation diagnosis is enabled.
Original NVD description (English source)
GNU Emacs before 25.3 allows remote attackers to execute arbitrary code via email with crafted "Content-Type: text/enriched" data containing an x-display XML element that specifies execution of shell commands, related to an unsafe text/enriched extension in lisp/textmodes/enriched.el, and unsafe Gnus support for enriched and richtext inline MIME objects in lisp/gnus/mm-view.el. In particular, an Emacs user can be instantly compromised by reading a crafted email message (or Usenet news article).