CVE-2026-96442
Received Received - Intake

Code Execution in Emacs via Flymake Language Backends

Publication date: 2026-09-23

Last updated on: 2026-09-23

Assigner: redhat-SADP

Description
A code execution flaw was found in Emacs, affecting versions prior to 31.2. The Flymake mode using language backends other than Lisp would execute arbitrary code from the edited file while performing syntax checking. Viewing or editing untrusted files using Emacs could lead to arbitrary code execution with the privileges of the user running Emacs.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-23
Last Modified
2026-09-23
Generated
2026-09-23
AI Q&A
2026-09-23
EPSS Evaluated
N/A
NVD
CVE-2026-96442
EUVD
EUVD-2026-85187

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
gnu emacs to 31.2 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-94 The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-96442 is a code execution flaw in Emacs versions prior to 31.2. The Flymake mode, when using language backends other than Lisp, executes arbitrary code from edited files during syntax checking. This allows attackers to run malicious code with the privileges of the user running Emacs if they view or edit untrusted files.

Detection Guidance

This vulnerability is specific to Emacs and cannot be detected via standard network or system commands. To check if your Emacs version is vulnerable, run 'emacs --version' and verify if it is prior to 31.2. If you are using a vulnerable version, upgrade to Emacs 31.2 or later immediately.

Impact Analysis

If you use Emacs to view or edit untrusted files, this vulnerability could allow arbitrary code execution on your system. Attackers could exploit it to run malicious commands, potentially stealing data, installing malware, or taking control of your system with your user privileges.

Compliance Impact

This vulnerability could lead to unauthorized code execution, potentially violating data confidentiality and integrity requirements in GDPR and HIPAA. Organizations using vulnerable Emacs versions may face compliance risks if untrusted files are processed, as it could result in data breaches or unauthorized access to sensitive information.

Mitigation Strategies

Upgrade Emacs to version 31.2 or later to address the incomplete fix for CVE-2024-53920. This version includes a more aggressive fix that generalizes the trusted-content-p check to all Flymake backends.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-96442. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart