CVE-2026-96269
CVSS Score
0.0
EPSS Score
0.2%
EPSS Percentile
8th
GNU Emacs 28.1 through 31.1 allows arbitrary code execution upon opening a file, because an untrusted value of read-symbol-shorthands affects the intern and unintern functions. This affects the default configuration; no particular user settings are required to trigger it.
| CWE | CWE-829 |
| Vendor | gnu |
| Product | emacs |
| Published | Sep 22, 2026 |
| Last Updated | Sep 24, 2026 |
Stay Ahead of the Next One
Get instant alerts for gnu emacs
Be the first to know when new unknown vulnerabilities affecting gnu emacs are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
Affected Versions
GNU / Emacs
28.1 ≤ 31.1
References
yhetil.org: https://yhetil.org/emacs/[email protected]/T/#m319545e835fb71d764bf868166632d4633167a75 debbugs.gnu.org: https://debbugs.gnu.org/cgi/bugreport.cgi?bug=80574#227 eshelyaron.com: https://eshelyaron.com/posts/2026-08-06-emacs-arbitrary-code-execution-returns.html openwall.com: https://www.openwall.com/lists/oss-security/2026/08/20/3