CVE-2026-96442
HighCVSS 7.8Exploitation Probability (EPSS)
Low risk5th percentile - higher than 5% of all known CVEs
Summary
A code execution flaw was found in Emacs, affecting versions prior to 31.2. The Flymake mode using language backends other than Lisp would execute arbitrary code from the edited file while performing syntax checking. Viewing or editing untrusted files using Emacs could lead to arbitrary code execution with the privileges of the user running Emacs.
Risk Assessment
Opening or editing a malicious file in Emacs may lead to arbitrary code execution with the user's privileges, potentially resulting in account or system compromise.
Recommendation
Update Emacs to version 31.2 or later. Avoid opening untrusted files in Emacs until the update is applied.
Other vulnerabilities in Emacs
See all- CVE-2014-9483High
Emacs 24.4 allows remote attackers to bypass security restrictions.
- CVE-2025-1244High
A command injection vulnerability was discovered in the Emacs text editor. A remote, unauthenticated attacker can exploit it to execute arbitrary shell commands on a vulnerable system. The attack is triggered by tricking users into visiting a specially crafted website or an HTTP URL with a redirect.
- CVE-2000-0271Medium
The read-passwd and other Lisp functions in Emacs 20 do not properly clear the history of recently typed keys, allowing an attacker to read unencrypted passwords.
- CVE-2000-0269Low
Emacs 20 does not properly set permissions for a slave PTY device when starting a new subprocess, which allows local users to read or modify communications between Emacs and the subprocess.
- CVE-2000-0270Low
The make-temp-name function in Emacs 20 creates temporary files with predictable names, allowing attackers to conduct a symlink attack.
Original NVD description (English source)
A code execution flaw was found in Emacs, affecting versions prior to 31.2. The Flymake mode using language backends other than Lisp would execute arbitrary code from the edited file while performing syntax checking. Viewing or editing untrusted files using Emacs could lead to arbitrary code execution with the privileges of the user running Emacs.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS