CVE-2026-96442

Emacs: emacs: arbitrary code execution in flymake mode

Published Sep 23, 2026 CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed
Description
A code execution flaw was found in Emacs, affecting versions prior to 31.2. The Flymake mode using language backends other than Lisp would execute arbitrary code from the edited file while performing syntax checking. Viewing or editing untrusted files using Emacs could lead to arbitrary code execution with the privileges of the user running Emacs.

Remediation

Vendor Workaround

To mitigate this issue, users should avoid opening or editing untrusted text files with Emacs. Exercise caution when handling files from unknown or suspicious sources, as interacting with them can lead to arbitrary code execution.

Tracking

Sign in to view the affected projects.

Advisories

No advisories available
History
Type Values Removed Values Added
CPEs cpe:/o:redhat:enterprise_linux:10.3
References
Type Values Removed Values Added
First Time appeared Redhat rhel Els
CPEs cpe:/o:redhat:enterprise_linux:6
cpe:/o:redhat:enterprise_linux:7
cpe:/o:redhat:rhel_els:6
cpe:/o:redhat:rhel_els:7
Vendors & Products Redhat rhel Els
Type Values Removed Values Added
CPEs cpe:/o:redhat:enterprise_linux:8 cpe:/a:redhat:enterprise_linux:8::appstream
cpe:/o:redhat:enterprise_linux:8::baseos
References
Type Values Removed Values Added
CPEs cpe:/o:redhat:enterprise_linux:9 cpe:/a:redhat:enterprise_linux:9::appstream
References
Type Values Removed Values Added
CPEs cpe:/o:redhat:enterprise_linux:10 cpe:/o:redhat:enterprise_linux:10.2
References
Type Values Removed Values Added
Title Emacs: emacs: arbitrary code execution, incomplete fix for cve-2024-53920 Emacs: emacs: arbitrary code execution in flymake mode
Type Values Removed Values Added
First Time appeared Gnu
Gnu emacs
Vendors & Products Gnu
Gnu emacs
Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Type Values Removed Values Added
Description A code execution flaw was found in Emacs, affecting versions prior to 31.2. The Flymake mode using language backends other than Lisp would execute arbitrary code from the edited file while performing syntax checking. Viewing or editing untrusted files using Emacs could lead to arbitrary code execution with the privileges of the user running Emacs.
Title Emacs: emacs: arbitrary code execution, incomplete fix for cve-2024-53920
First Time appeared Redhat
Redhat enterprise Linux
Weaknesses CWE-94
CPEs cpe:/o:redhat:enterprise_linux:10
cpe:/o:redhat:enterprise_linux:6
cpe:/o:redhat:enterprise_linux:7
cpe:/o:redhat:enterprise_linux:8
cpe:/o:redhat:enterprise_linux:9
Vendors & Products Redhat
Redhat enterprise Linux
References
Metrics cvssV3_1

{'score': 7.8, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H'}

Weaknesses

Sources

Status
PUBLISHED
Assigner
redhat
Published
Updated
Nov 12, 2026, 5:26 AM
Reserved
Sep 23, 2026, 8:58 AM
Status
Awaiting Analysis
Published
Sep 23, 2026, 11:17 AM
Modified
Nov 12, 2026, 6:17 AM
Severity
Important
Public date
Sep 14, 2026, 12:00 AM