{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-96269", "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "state": "PUBLISHED", "assignerShortName": "mitre", "dateReserved": "2026-09-22T20:32:40.413Z", "datePublished": "2026-09-22T20:32:40.834Z", "dateUpdated": "2026-09-24T01:51:40.685Z"}, "containers": {"cna": {"affected": [{"defaultStatus": "unknown", "modules": ["File editing/viewing"], "product": "Emacs", "repo": "https://cgit.git.savannah.gnu.org/cgit/emacs.git", "vendor": "GNU", "versions": [{"lessThanOrEqual": "31.1", "status": "affected", "version": "28.1", "versionType": "custom"}]}], "descriptions": [{"lang": "en", "value": "GNU Emacs 28.1 through 31.1 allows arbitrary code execution upon opening a file, because an untrusted value of read-symbol-shorthands affects the intern and unintern functions. This affects the default configuration; no particular user settings are required to trigger it."}], "metrics": [{"cvssV4_0": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "PRESENT", "attackVector": "LOCAL", "baseScore": 7.5, "baseSeverity": "HIGH", "privilegesRequired": "NONE", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N", "version": "4.0", "vulnAvailabilityImpact": "HIGH", "vulnConfidentialityImpact": "HIGH", "vulnIntegrityImpact": "HIGH", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "problemTypes": [{"descriptions": [{"cweId": "CWE-829", "description": "CWE-829 Inclusion of Functionality from Untrusted Control Sphere", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "shortName": "mitre", "dateUpdated": "2026-09-22T20:32:40.834Z"}, "references": [{"url": "https://yhetil.org/emacs/jwvtsph1aoj.fsf-monnier+emacs@gnu.org/T/#m319545e835fb71d764bf868166632d4633167a75"}, {"url": "https://debbugs.gnu.org/cgi/bugreport.cgi?bug=80574#227"}], "tags": ["x_open-source"], "x_generator": {"engine": "CVE-Request-form 0.0.1"}, "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:a:gnu:emacs:*:*:*:*:*:*:*:*", "versionStartIncluding": "28.1", "versionEndIncluding": "31.1"}]}]}]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-09-22T20:47:44.364030Z", "id": "CVE-2026-96269", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-09-22T20:47:53.328Z"}}, {"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2026-09-24T01:51:40.685Z"}, "references": [{"url": "https://eshelyaron.com/posts/2026-08-06-emacs-arbitrary-code-execution-returns.html"}, {"url": "https://www.openwall.com/lists/oss-security/2026/08/20/3"}], "title": "CVE Program Container", "x_generator": {"engine": "ADPogram 0.0.1"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CVE Program Container", "references": [{"url": "https://eshelyaron.com/posts/2026-08-06-emacs-arbitrary-code-execution-returns.html"}, {"url": "https://www.openwall.com/lists/oss-security/2026/08/20/3"}], "x_generator": {"engine": "ADPogram 0.0.1"}, "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2026-09-24T01:51:40.685Z"}}, {"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-96269", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-09-22T20:47:44.364030Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-09-22T20:47:50.487Z"}}], "cna": {"tags": ["x_open-source"], "metrics": [{"format": "CVSS", "cvssV4_0": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 7.5, "Automatable": "NOT_DEFINED", "attackVector": "LOCAL", "baseSeverity": "HIGH", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "PRESENT", "privilegesRequired": "NONE", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "HIGH", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "HIGH", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "HIGH", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"repo": "https://cgit.git.savannah.gnu.org/cgit/emacs.git", "vendor": "GNU", "modules": ["File editing/viewing"], "product": "Emacs", "versions": [{"status": "affected", "version": "28.1", "versionType": "custom", "lessThanOrEqual": "31.1"}], "defaultStatus": "unknown"}], "references": [{"url": "https://yhetil.org/emacs/jwvtsph1aoj.fsf-monnier+emacs@gnu.org/T/#m319545e835fb71d764bf868166632d4633167a75"}, {"url": "https://debbugs.gnu.org/cgi/bugreport.cgi?bug=80574#227"}], "x_generator": {"engine": "CVE-Request-form 0.0.1"}, "descriptions": [{"lang": "en", "value": "GNU Emacs 28.1 through 31.1 allows arbitrary code execution upon opening a file, because an untrusted value of read-symbol-shorthands affects the intern and unintern functions. This affects the default configuration; no particular user settings are required to trigger it."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-829", "description": "CWE-829 Inclusion of Functionality from Untrusted Control Sphere"}]}], "cpeApplicability": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:gnu:emacs:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndIncluding": "31.1", "versionStartIncluding": "28.1"}], "operator": "OR"}]}], "providerMetadata": {"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "shortName": "mitre", "dateUpdated": "2026-09-22T20:32:40.834Z"}}}, "cveMetadata": {"cveId": "CVE-2026-96269", "state": "PUBLISHED", "dateUpdated": "2026-09-24T01:51:40.685Z", "dateReserved": "2026-09-22T20:32:40.413Z", "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "datePublished": "2026-09-22T20:32:40.834Z", "assignerShortName": "mitre"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unknown", "modules": ["File editing/viewing"], "product": "Emacs", "repo": "https://cgit.git.savannah.gnu.org/cgit/emacs.git", "vendor": "GNU", "versions": [{"lessThanOrEqual": "31.1", "status": "affected", "version": "28.1", "versionType": "custom"}]}], "source": "cve@mitre.org"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "GNU Emacs 28.1 through 31.1 allows arbitrary code execution upon opening a file, because an untrusted value of read-symbol-shorthands affects the intern and unintern functions. This affects the default configuration; no particular user settings are required to trigger it."}], "id": "CVE-2026-96269", "lastModified": "2026-09-24T21:00:46.893", "metrics": {"cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "PRESENT", "attackVector": "LOCAL", "availabilityRequirement": "NOT_DEFINED", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "NONE", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "HIGH", "vulnConfidentialityImpact": "HIGH", "vulnIntegrityImpact": "HIGH", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "cve@mitre.org", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-96269", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2026-09-22T20:47:44.364030Z", "version": "2.0.3"}}]}, "published": "2026-09-22T21:17:35.150", "references": [{"source": "cve@mitre.org", "url": "https://debbugs.gnu.org/cgi/bugreport.cgi?bug=80574#227"}, {"source": "cve@mitre.org", "url": "https://yhetil.org/emacs/jwvtsph1aoj.fsf-monnier+emacs@gnu.org/T/#m319545e835fb71d764bf868166632d4633167a75"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "https://eshelyaron.com/posts/2026-08-06-emacs-arbitrary-code-execution-returns.html"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "https://www.openwall.com/lists/oss-security/2026/08/20/3"}], "sourceIdentifier": "cve@mitre.org", "vulnStatus": "Awaiting Analysis", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-829"}], "source": "cve@mitre.org", "type": "Secondary"}]}

{"bugzilla": {"description": "emacs: GNU Emacs: Arbitrary code execution upon opening a file", "id": "2538925", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2538925"}, "csaw": false, "cvss3": {"cvss3_base_score": "7.8", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "status": "draft"}, "cwe": "CWE-94", "details": ["A flaw was found in GNU Emacs. A remote attacker could achieve arbitrary code execution by tricking a user into opening a specially crafted file. This vulnerability arises because an untrusted value of read-symbol-shorthands affects the intern and unintern functions, allowing for code execution without specific user settings."], "mitigation": {"lang": "en:us", "value": "To mitigate this issue, users should avoid opening untrusted or suspicious files directly with GNU Emacs. Exercise caution when handling files from unknown sources or those with unexpected content, as opening them could lead to arbitrary code execution."}, "name": "CVE-2026-96269", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Affected", "package_name": "emacs", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Not affected", "package_name": "emacs", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "emacs", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "emacs", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "emacs", "product_name": "Red Hat Enterprise Linux 9"}], "public_date": "2026-09-22T20:32:40Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-96269\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-96269\nhttps://debbugs.gnu.org/cgi/bugreport.cgi?bug=80574#227\nhttps://eshelyaron.com/posts/2026-08-06-emacs-arbitrary-code-execution-returns.html\nhttps://yhetil.org/emacs/jwvtsph1aoj.fsf-monnier+emacs@gnu.org/T/#m319545e835fb71d764bf868166632d4633167a75"], "threat_severity": "Important"}