CVE-2026-96269 Code injection in Emacs
Attackers can execute arbitrary code by tricking users into opening a malicious file in GNU Emacs due to unsafe symbol handling.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-96269?
CVE-2026-96269 is a high-severity code injection vulnerability in GNU Emacs, published on 22 Sep 2026. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
GNU Emacs 28.1 through 31.1 allows arbitrary code execution upon opening a file, because an untrusted value of read-symbol-shorthands affects the intern and unintern functions. This affects the default configuration; no particular user settings are required to trigger it.
Weakness: CWE-829
Which versions are affected by CVE-2026-96269?
Linux distribution packages (6)
emacs AlmaLinux:10 | All versions | 1:29.4-14.el10_2.4 |
emacs-common AlmaLinux:10 | All versions | 1:29.4-14.el10_2.4 |
emacs-filesystem AlmaLinux:10 | All versions | 1:29.4-14.el10_2.4 |
emacs-lucid AlmaLinux:10 | All versions | 1:29.4-14.el10_2.4 |
emacs-nw AlmaLinux:10 | All versions | 1:29.4-14.el10_2.4 |
emacs Rocky Linux:10 | All versions | 1:29.4-14.el10_2.4 |
How do I fix CVE-2026-96269?
Apply the vendor's patch.
Upgrade, and never evaluate templates, expressions or code built from user input. More about Code injection.
Is CVE-2026-96269 being exploited?
There is no known exploitation of CVE-2026-96269 in the wild and no public exploit code.
Sources
Also known as ALSA-2026:90887, AZL-103410, DEBIAN-CVE-2026-96269, GHSA-29x7-3q83-3x3v, RLSA-2026:90887, UBUNTU-CVE-2026-96269.