Emacs (Gnu) - vulnerabilities (CVEs)

42 CVEs, 1 in the last 30 days, 114 known versions, newest CVE from 2026-10-11. Vendor: Gnu.

CVEs of Emacs

CVE-2026-108976 - CVSS 7.8 (high), 2026-10-11: GNU Emacs before 31.2 (and TRAMP through 2.8.2) allows OS command injection via a filename because tramp-user-regexp has an incomplete list of disallowed…
CVE-2026-96269 - CVSS 7.5 (high), 2026-09-22: GNU Emacs 28.1 through 31.1 allows arbitrary code execution upon opening a file, because an untrusted value of read-symbol-shorthands affects the intern and…
CVE-2026-77219 - CVSS 7.1 (high), 2026-08-21: GNU Emacs before 31.0.91 contains an integer overflow in the PBM/PPM/PGM image loader that allows an attacker to leak heap memory contents by supplying a…
CVE-2026-71394 - CVSS 5.3 (medium), 2026-08-10: GNU Emacs for Android improperly validates the table header input in sfnt_read_table_directory() in src/sfnt.c. Due to an incorrect comparison variable in the…
CVE-2026-71393 - CVSS 5.3 (medium), 2026-08-10: GNU Emacs for Android is vulnerable to an integer overflow in sfnt_read_name_table() in src/sfnt.c. The function computes an allocation size using a 32-bit…
CVE-2026-71392 - CVSS 5.3 (medium), 2026-08-10: GNU Emacs for Android is vulnerable to an integer overflow in the sfnt_read_cmap_format_12() function in src/sfnt.c. When processing a crafted TrueType font…
CVE-2026-71391 - CVSS 5.3 (medium), 2026-08-10: GNU Emacs for Android contains an off-by-one error in the gvar table parser in src/sfnt.c. The shared-coordinate index boundary check in…
CVE-2026-6861 - CVSS 7.1 (high), 2026-04-22: A flaw was found in GNU Emacs. This vulnerability, a memory corruption issue, occurs when Emacs processes specially crafted SVG (Scalable Vector Graphics) CSS…
CVE-2024-53920 - CVSS 7.8 (high), 2024-11-27: In elisp-mode.el in GNU Emacs before 30.1, a user who chooses to invoke elisp-completion-at-point (for code completion) on untrusted Emacs Lisp source code…
CVE-2024-39331 - CVSS 9.8 (critical), 2024-06-23: In Emacs before 29.4, org-link-expand-abbrev in lisp/ol.el expands a %(...) link abbrev even when it specifies an unsafe function, such as…
CVE-2024-30204 - CVSS 2.8 (low), 2024-03-25: In Emacs before 29.3, LaTeX preview is enabled by default for e-mail attachments.
CVE-2024-30203 - CVSS 5.5 (medium), 2024-03-25: In Emacs before 29.3, Gnus treats inline MIME contents as trusted.
CVE-2024-30202 - CVSS 7.8 (high), 2024-03-25: In Emacs before 29.3, arbitrary Lisp code is evaluated as part of turning on Org mode. This affects Org Mode before 9.6.23.
CVE-2024-30205 - CVSS 7.1 (high), 2024-03-25: In Emacs before 29.3, Org mode considers contents of remote files to be trusted. This affects Org Mode before 9.6.23.
CVE-2023-2491 - CVSS 7.8 (high), 2023-05-17: A flaw was found in the Emacs text editor. Processing a specially crafted org-mode code with the "org-babel-execute:latex" function in ob-latex.el can result…
CVE-2023-27986 - CVSS 7.8 (high), 2023-03-09: emacsclient-mail.desktop in Emacs 28.1 through 28.2 is vulnerable to Emacs Lisp code injections through a crafted mailto: URI with unescaped double-quote…
CVE-2023-27985 - CVSS 7.8 (high), 2023-03-09: emacsclient-mail.desktop in Emacs 28.1 through 28.2 is vulnerable to shell command injections through a crafted mailto: URI. This is related to lack of…
CVE-2022-48338 - CVSS 7.3 (high), 2023-02-20: An issue was discovered in GNU Emacs through 28.2. In ruby-mode.el, the ruby-find-library-file function has a local command injection vulnerability. The…
CVE-2022-48337 - CVSS 9.8 (critical), 2023-02-20: GNU Emacs through 28.2 allows attackers to execute commands via shell metacharacters in the name of a source-code file, because lib-src/etags.c uses the…
CVE-2022-48339 - CVSS 7.8 (high), 2023-02-20: An issue was discovered in GNU Emacs through 28.2. htmlfontify.el has a command injection vulnerability. In the hfy-istext-command function, the parameter…
CVE-2022-45939 - CVSS 7.8 (high), 2022-11-28: GNU Emacs through 28.2 allows attackers to execute commands via shell metacharacters in the name of a source-code file, because lib-src/etags.c uses the…
CVE-2017-1000383 - CVSS 5.5 (medium), 2017-10-31: GNU Emacs version 25.3.1 (and other versions most likely) ignores umask when creating a backup save file ("[ORIGINAL_FILENAME]~") resulting in files that may…
CVE-2017-14482 - CVSS 8.8 (high), 2017-09-14: GNU Emacs before 25.3 allows remote attackers to execute arbitrary code via email with crafted "Content-Type: text/enriched" data containing an x-display XML…
CVE-2014-9483 - CVSS 7.5 (high), 2017-08-28: Emacs 24.4 allows remote attackers to bypass security restrictions.
CVE-2014-3421 - CVSS 3.3 (low), 2014-05-08: lisp/gnus/gnus-fun.el in GNU Emacs 24.3 and earlier allows local users to overwrite arbitrary files via a symlink attack on the /tmp/gnus.face.ppm temporary…
CVE-2014-3424 - CVSS 3.3 (low), 2014-05-08: lisp/net/tramp-sh.el in GNU Emacs 24.3 and earlier allows local users to overwrite arbitrary files via a symlink attack on a /tmp/tramp.##### temporary file.
CVE-2014-3423 - CVSS 3.3 (low), 2014-05-08: lisp/net/browse-url.el in GNU Emacs 24.3 and earlier allows local users to overwrite arbitrary files via a symlink attack on a /tmp/Mosaic.##### temporary file.
CVE-2014-3422 - CVSS 3.3 (low), 2014-05-08: lisp/emacs-lisp/find-gc.el in GNU Emacs 24.3 and earlier allows local users to overwrite arbitrary files via a symlink attack on a temporary file under…
CVE-2012-3479 - CVSS 6.8 (medium), 2012-08-25: lisp/files.el in Emacs 23.2, 23.3, 23.4, and 24.1 automatically executes eval forms in local-variable sections when the enable-local-variables option is set…
CVE-2012-0035 - CVSS 9.3 (critical), 2012-01-19: Untrusted search path vulnerability in EDE in CEDET before 1.0.1, as used in GNU Emacs before 23.4 and other products, allows local users to gain privileges…
CVE-2010-0825 - CVSS 4.4 (medium), 2010-04-05: lib-src/movemail.c in movemail in emacs 22 and 23 allows local users to read, modify, or delete arbitrary mailbox files via a symlink attack, related to…
CVE-2008-2142 - CVSS 6.8 (medium), 2008-05-12: Emacs 21 and XEmacs automatically load and execute .flc (fast lock) files that are associated with other files that are edited within Emacs, which allows…
CVE-2008-1694 - CVSS 4.6 (medium), 2008-04-22: vcdiff in Emacs 20.7 to 22.1.50, when used with SCCS, allows local users to overwrite arbitrary files via a symlink attack on temporary files.
CVE-2007-6109 - CVSS 10 (critical), 2007-12-07: Stack-based buffer overflow in emacs allows user-assisted attackers to cause a denial of service (application crash) and possibly have unspecified other…
CVE-2007-5795 - CVSS 6.3 (medium), 2007-11-02: The hack-local-variables function in Emacs before 22.2, when enable-local-variables is set to :safe, does not properly search lists of unsafe or risky…
CVE-2007-2833 - CVSS 7.8 (high), 2007-06-21: Emacs 21 allows user-assisted attackers to cause a denial of service (crash) via certain crafted images, as demonstrated via a GIF image in vm mode, related…
CVE-2005-0100 - CVSS 7.5 (high), 2005-02-07: Format string vulnerability in the movemail utility in (1) Emacs 20.x, 21.3, and possibly other versions, and (2) XEmacs 21.4 and earlier, allows remote…
CVE-2003-1232 - CVSS 5.1 (medium), 2003-12-31: Emacs 21.2.1 does not prompt or warn the user before executing Lisp code in the local variables section of a text file, which allows user-assisted attackers…
CVE-2001-1301 - CVSS 1.2 (low), 2001-08-07: rcs2log, as used in Emacs 20.4, xemacs 21.1.10 and other versions before 21.4, and possibly other packages, allows local users to modify files of other users…
CVE-2000-0270 - CVSS 3.6 (low), 2000-04-18: The make-temp-name Lisp function in Emacs 20 creates temporary files with predictable names, which allows attackers to conduct a symlink attack.
CVE-2000-0269 - CVSS 2.1 (low), 2000-04-18: Emacs 20 does not properly set permissions for a slave PTY device when starting a new subprocess, which allows local users to read or modify communications…
CVE-2000-0271 - CVSS 4.6 (medium), 2000-04-18: read-passwd and other Lisp functions in Emacs 20 do not properly clear the history of recently typed keys, which allows an attacker to read unencrypted…