CVE-2026-77219

Received Received - Intake

Integer Overflow in GNU Emacs PBM/PPM/PGM Image Loader

Publication date: 2026-08-21

Last updated on: 2026-08-21

Assigner: VulnCheck

Description

GNU Emacs before 31.0.91 contains an integer overflow in the PBM/PPM/PGM image loader that allows an attacker to leak heap memory contents by supplying a crafted image with large dimensions and an elevated max color index. The image loader multiplies image dimensions and channel count using signed integer arithmetic; for sufficiently large values, the result wraps to a negative number, bypassing the bounds check and causing the pixel reader to access heap memory past the end of the allocated buffer. The over-read contents are interpreted as pixel color values and rendered on screen.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-21

Last Modified

2026-08-21

Generated

2026-08-22

AI Q&A

2026-08-22

EPSS Evaluated

N/A

NVD

CVE-2026-77219

EUVD

EUVD-2026-64138

Affected Vendors & Products

Vendor	Product	Version / Range
gnu	emacs	to 31.0.91 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-190	The product performs a calculation that can produce an integer overflow or wraparound when the logic assumes that the resulting value will always be larger than the original value. This occurs when an integer value is incremented to a value that is too large to store in the associated representation. When this occurs, the value may become a very small or negative number.
CWE-125	The product reads data past the end, or before the beginning, of the intended buffer.

Attack-Flow Graph

Executive Summary

GNU Emacs before version 31.0.91 has an integer overflow in its PBM/PPM/PGM image loader. When processing a crafted image with large dimensions and a high max color index, the loader performs signed integer multiplication of dimensions and channel count. If the result overflows to a negative number, it bypasses bounds checks and causes the pixel reader to access heap memory beyond the allocated buffer. This leads to an over-read, leaking heap memory contents which are then rendered as pixel colors on screen.

Detection Guidance

Detecting this vulnerability requires checking the version of GNU Emacs installed on your system. If you are running a version before 31.0.91, the system is vulnerable. Use the command 'emacs --version' to check the installed version.

Impact Analysis

This vulnerability could allow an attacker to read sensitive memory contents from your system if you open a maliciously crafted image file in GNU Emacs. The leaked memory might contain confidential data, potentially including passwords or other sensitive information. While it does not directly execute code, the exposure of memory contents could lead to further exploitation or privacy breaches depending on the system and data involved.

Compliance Impact

This vulnerability could impact compliance with GDPR and HIPAA by potentially exposing sensitive personal or health data through memory leaks. GDPR requires protection of personal data, and HIPAA mandates safeguards for protected health information. If exploited, this flaw might lead to unauthorized data disclosure, violating these regulations and resulting in legal or financial penalties for affected organizations.

Mitigation Strategies

Immediately update GNU Emacs to version 31.0.91 or later. If updating is not possible, avoid opening untrusted image files in Emacs until the update is applied.

Hi! I’m here to help you understand CVE-2026-77219. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70