Description
GNU Emacs 28.1 through 31.1 allows arbitrary code execution upon opening a file, because an untrusted value of read-symbol-shorthands affects the intern and unintern functions. This affects the default configuration; no particular user settings are required to trigger it.
Published: 2026-09-22
Score: 7.5 High
EPSS: < 1% Very Low
KEV: No
Impact: Arbitrary code execution
Action: Immediate Update
AI Analysis

Impact

GNU Emacs versions 28.1 through 31.1 contain a flaw that permits arbitrary code execution when a user opens a file. The flaw stems from the handling of the untrusted value of the variable read-symbol-shorthands, which influences the intern and unintern functions in a way that can be exploited to execute code. This issue involves improper privilege management (CWE‑829) and improper control over code generation (CWE‑94), leading to a complete loss of confidentiality, integrity, and availability for the user’s session.

Affected Systems

The affected product is GNU Emacs, versions 28.1 up to and including 31.1. All installations of these versions that use the default configuration are potentially vulnerable.

Risk and Exploitability

The CVSS score of 7.5 indicates high severity. The EPSS score is not available, but the vulnerability is not listed in CISA KEV. The likely attack vector is local: a user that opens a file – even from an untrusted source – can exploit the flaw. The vulnerability involves improper privilege management (CWE‑829) and code generation mistakes (CWE‑94). The effect is complete loss of confidentiality, integrity, and availability for the user’s session. Due to the lack of an official patch or workaround in the provided data, this remains a significant risk for users of the affected versions.

Generated by OpenCVE AI on September 23, 2026 at 14:02 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Upgrade to a patched Emacs release (31.2 or later) as soon as it becomes available.
  • Avoid opening files from untrusted sources until an update is applied; consider using a dedicated, isolated sandbox for handling unknown files.
  • Configure the Emacs environment to disable or sanitize read-symbol-shorthands by setting it to nil or using a safe configuration if such a setting is supported.
  • Monitor the Emacs GNU mailing list and security advisories for a formal fix or additional mitigations.

Generated by OpenCVE AI on September 23, 2026 at 14:02 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Thu, 24 Sep 2026 02:30:00 +0000

Type Values Removed Values Added
References

Wed, 23 Sep 2026 12:30:00 +0000

Type Values Removed Values Added
Title Arbitrary Code Execution via read-symbol-shorthands in GNU Emacs emacs: GNU Emacs: Arbitrary code execution upon opening a file
Weaknesses CWE-94
References
Metrics threat_severity

None

 cvssV3_1

{'score': 7.8, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H'}

threat_severity

Important

Tue, 22 Sep 2026 21:45:00 +0000

Type Values Removed Values Added
Title Arbitrary Code Execution via read-symbol-shorthands in GNU Emacs

Tue, 22 Sep 2026 21:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Tue, 22 Sep 2026 20:45:00 +0000

Type Values Removed Values Added
Description GNU Emacs 28.1 through 31.1 allows arbitrary code execution upon opening a file, because an untrusted value of read-symbol-shorthands affects the intern and unintern functions. This affects the default configuration; no particular user settings are required to trigger it.
First Time appeared Gnu
Gnu emacs
Weaknesses CWE-829
CPEs cpe:2.3:a:gnu:emacs:*:*:*:*:*:*:*:*
Vendors & Products Gnu
Gnu emacs
References
Metrics cvssV4_0

{'score': 7.5, 'vector': 'CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N'}

Subscriptions

Gnu Emacs
cve-icon MITRE

Status: PUBLISHED

Assigner: mitre

Published:

Updated: 2026-09-24T01:51:40.685Z

Reserved: 2026-09-22T20:32:40.413Z

Link: CVE-2026-96269

cve-icon Vulnrichment

Updated: 2026-09-24T01:51:40.685Z

cve-icon NVD

Status : Awaiting Analysis

Published: 2026-09-22T21:17:35.150

Modified: 2026-09-24T21:00:46.893

Link: CVE-2026-96269

cve-icon Redhat

Severity : Important

Publid Date: 2026-09-22T20:32:40Z

Links: CVE-2026-96269 - Bugzilla

cve-icon OpenCVE Enrichment

Updated: 2026-09-23T14:15:06Z

Weaknesses
  • CWE-829

    Inclusion of Functionality from Untrusted Control Sphere

  • CWE-94

    Improper Control of Generation of Code ('Code Injection')