CVE-2026-96269

Received Received - Intake

Arbitrary Code Execution in GNU Emacs

Publication date: 2026-09-22

Last updated on: 2026-09-22

Assigner: MITRE

Description

GNU Emacs 28.1 through 31.1 allows arbitrary code execution upon opening a file, because an untrusted value of read-symbol-shorthands affects the intern and unintern functions. This affects the default configuration; no particular user settings are required to trigger it.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-22

Last Modified

2026-09-22

Generated

2026-09-23

AI Q&A

2026-09-23

EPSS Evaluated

N/A

NVD

CVE-2026-96269

Affected Vendors & Products

Vendor	Product	Version / Range
gnu	emacs	From 28.1 (inc) to 31.1 (inc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-829	The product imports, requires, or includes executable functionality (such as a library) from a source that is outside of the intended control sphere.

Attack-Flow Graph

Executive Summary

This vulnerability in GNU Emacs 28.1 through 31.1 allows arbitrary code execution when a file is opened. It occurs because a malicious value in read-symbol-shorthands can manipulate the intern and unintern functions, which are used to manage symbols in Emacs Lisp. The default configuration is affected, meaning no special user settings are needed to trigger the issue.

Detection Guidance

This vulnerability is triggered when opening a file with GNU Emacs versions 28.1 through 31.1 due to unsafe handling of read-symbol-shorthands. To detect it, check your Emacs version with 'emacs --version'. If it falls within the affected range, update immediately. No specific commands detect exploitation, but monitoring for unusual file access or process behavior may help.

Impact Analysis

If exploited, this vulnerability could allow an attacker to execute arbitrary code on your system when you open a specially crafted file. This could lead to unauthorized access, data theft, or further compromise of your system. Users running vulnerable versions of Emacs are at risk.

Compliance Impact

This vulnerability could lead to unauthorized code execution, potentially resulting in data breaches. For GDPR, this may violate principles of data protection and lead to fines. For HIPAA, it could compromise protected health information, risking compliance violations and penalties.

Mitigation Strategies

Update GNU Emacs to a version beyond 31.1 to address the arbitrary code execution risk. Avoid opening files from untrusted sources until patched.

Hi! I’m here to help you understand CVE-2026-96269. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70