CVE-2026-96269highCWE-829

CVE-2026-96269: high-severity vulnerability in GNU Emacs

Published · Updated

Follow this CVE+ Monitor Emacs+ Monitor emacs

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

21Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 7.5epss 0.1%
GNU Emacs 28.1 through 31.1 allows arbitrary code execution upon opening a file, because an untrusted value of read-symbol-shorthands affects the intern and unintern functions. This affects the default configuration; no particular user settings are required to trigger it.
CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Affected products
GNU · Emacs
Related CVEs — GNU Emacs

In the same product, most dangerous first.

CVE-2026-71393MEDIUMHeap Buffer Overflow in GNU Emacs for AndroidEPSS 0.7%CVE-2026-71392MEDIUMInteger Overflow in GNU Emacs for AndroidEPSS 0.7%CVE-2026-108976HIGHCVE-2026-108976EPSS 0.6%CVE-2026-71391MEDIUMOff-by-One Error in GNU Emacs for AndroidEPSS 0.5%CVE-2026-71394MEDIUMHeap Use of Uninitialized Memory in GNU Emacs for AndroidEPSS 0.4%CVE-2026-77219MEDIUMGNU Emacs < 31.0.91 Heap Over-Read via PBM/PPM/PGM Image LoaderEPSS 0.1%