The vulnerability is caused by an integer overflow in the PBM/PPM/PGM image loader of GNU Emacs. The loader calculates buffer size by multiplying image dimensions and channel count with signed integer arithmetic. When the dimensions and color index are large enough, the multiplication overflows to a negative number, bypassing bounds checking. This causes the pixel reader to reference memory past the allocated buffer, leaking contents of the as pixel color values that are rendered on screen. The result is a clear‑text disclosure of arbitrary heap data. The weakness maps to CWE-125 and CWE-190.

GNU Emacs installations with a version earlier than 31.0.91 are affected. The vulnerability is present in all releases prior to the 31.0.91 release, which contains the fix. Users of older Emacs versions or custom builds that have not incorporated the patch are at risk.

The CVSS score of 6.9 indicates a moderate severity weakness with potential for significant information leakage. No EPSS score is available, so the probability of exploitation is unknown, and the vulnerability is not listed in CISA’s KEV catalog. The likely attack vector is local: an attacker supplies a crafted image file with large dimensions and an elevated max color index, which forces the Emacs process to load the image. When the image loader performs the signed multiplication, the resulting overflow causes an out‑of‑bounds memory read, and the over‑read heap contents are interpreted as pixel colors and rendered on the screen.