CVE-2026-77219
Fixed in a distro release EPSS <1%CVSS 7.1
GNU Emacs before 31.0.91 contains an integer overflow in the PBM/PPM/PGM image loader that allows an attacker to leak heap memory contents by supplying a crafted image with large dimensions and an elevated max color index. The image loader multiplies image dimensions and channel count using signed integer arithmetic; for sufficiently large values, the result wraps to a negative number, bypassing the bounds check and causing the pixel reader to access heap memory past the end of the allocated buffer. The over-read contents are interpreted as pixel color values and rendered on screen.
Products: gnu emacs
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| AlmaLinux 10 | emacs | 1:29.4-14.el10_2.3 |
| AlmaLinux 10 | emacs-common | 1:29.4-14.el10_2.3 |
| AlmaLinux 10 | emacs-filesystem | 1:29.4-14.el10_2.3 |
| AlmaLinux 10 | emacs-lucid | 1:29.4-14.el10_2.3 |
| AlmaLinux 10 | emacs-nw | 1:29.4-14.el10_2.3 |
| AlmaLinux 8 | emacs | 1:26.1-15.el8_10.2 |
| AlmaLinux 8 | emacs-common | 1:26.1-15.el8_10.2 |
| AlmaLinux 8 | emacs-filesystem | 1:26.1-15.el8_10.2 |
| AlmaLinux 8 | emacs-lucid | 1:26.1-15.el8_10.2 |
| AlmaLinux 8 | emacs-nox | 1:26.1-15.el8_10.2 |
| AlmaLinux 8 | emacs-terminal | 1:26.1-15.el8_10.2 |
| AlmaLinux 9 | emacs | 1:27.2-18.el9_8.2 |
| AlmaLinux 9 | emacs-common | 1:27.2-18.el9_8.2 |
| AlmaLinux 9 | emacs-filesystem | 1:27.2-18.el9_8.2 |
| AlmaLinux 9 | emacs-lucid | 1:27.2-18.el9_8.2 |
| AlmaLinux 9 | emacs-nox | 1:27.2-18.el9_8.2 |
| Amazon Linux 2 | emacs | 1:27.2-4.amzn2.0.8 |
| Amazon Linux 2 | emacs-common | 1:27.2-4.amzn2.0.8 |
| Amazon Linux 2 | emacs-devel | 1:27.2-4.amzn2.0.8 |
| Amazon Linux 2 | emacs-filesystem | 1:27.2-4.amzn2.0.8 |
| Amazon Linux 2 | emacs-lucid | 1:27.2-4.amzn2.0.8 |
| Amazon Linux 2 | emacs-nox | 1:27.2-4.amzn2.0.8 |
| Amazon Linux 2 | emacs-terminal | 1:27.2-4.amzn2.0.8 |
| Amazon Linux 2023 | emacs | 1:28.2-3.amzn2023.0.11 |
| Amazon Linux 2023 | emacs-common | 1:28.2-3.amzn2023.0.11 |
| Amazon Linux 2023 | emacs-devel | 1:28.2-3.amzn2023.0.11 |
| Amazon Linux 2023 | emacs-filesystem | 1:28.2-3.amzn2023.0.11 |
| Amazon Linux 2023 | emacs-lucid | 1:28.2-3.amzn2023.0.11 |
| Amazon Linux 2023 | emacs-nox | 1:28.2-3.amzn2023.0.11 |
| Amazon Linux 2023 | emacs-terminal | 1:28.2-3.amzn2023.0.11 |
| Debian 12 | emacs | no fix |
| Debian 13 | emacs | no fix |
| Debian 14 | emacs | no fix |
| Red Hat Enterprise Linux 10.2 | emacs | 1:29.4-14.el10_2.3 |
| Red Hat Enterprise Linux 10.2 | emacs-common | 1:29.4-14.el10_2.3 |
| Red Hat Enterprise Linux 10.2 | emacs-common-debuginfo | 1:29.4-14.el10_2.3 |
| Red Hat Enterprise Linux 10.2 | emacs-debuginfo | 1:29.4-14.el10_2.3 |
| Red Hat Enterprise Linux 10.2 | emacs-debugsource | 1:29.4-14.el10_2.3 |
| Red Hat Enterprise Linux 10.2 | emacs-filesystem | 1:29.4-14.el10_2.3 |
| Red Hat Enterprise Linux 10.2 | emacs-gtk+x11-debuginfo | 1:29.4-14.el10_2.3 |
| Red Hat Enterprise Linux 10.2 | emacs-lucid | 1:29.4-14.el10_2.3 |
| Red Hat Enterprise Linux 10.2 | emacs-lucid-debuginfo | 1:29.4-14.el10_2.3 |
| Red Hat Enterprise Linux 10.2 | emacs-nw | 1:29.4-14.el10_2.3 |
| Red Hat Enterprise Linux 10.2 | emacs-nw-debuginfo | 1:29.4-14.el10_2.3 |
| Red Hat Enterprise Linux 8 | emacs | 1:26.1-15.el8_10.2 |
| Red Hat Enterprise Linux 8 | emacs-common | 1:26.1-15.el8_10.2 |
| Red Hat Enterprise Linux 8 | emacs-common-debuginfo | 1:26.1-15.el8_10.2 |
| Red Hat Enterprise Linux 8 | emacs-debuginfo | 1:26.1-15.el8_10.2 |
| Red Hat Enterprise Linux 8 | emacs-debugsource | 1:26.1-15.el8_10.2 |
| Red Hat Enterprise Linux 8 | emacs-filesystem | 1:26.1-15.el8_10.2 |
| Red Hat Enterprise Linux 8 | emacs-lucid | 1:26.1-15.el8_10.2 |
| Red Hat Enterprise Linux 8 | emacs-lucid-debuginfo | 1:26.1-15.el8_10.2 |
| Red Hat Enterprise Linux 8 | emacs-nox | 1:26.1-15.el8_10.2 |
| Red Hat Enterprise Linux 8 | emacs-nox-debuginfo | 1:26.1-15.el8_10.2 |
| Red Hat Enterprise Linux 8 | emacs-terminal | 1:26.1-15.el8_10.2 |
| Red Hat Enterprise Linux 9 | emacs | 1:27.2-18.el9_8.2 |
| Red Hat Enterprise Linux 9 | emacs-common | 1:27.2-18.el9_8.2 |
| Red Hat Enterprise Linux 9 | emacs-common-debuginfo | 1:27.2-18.el9_8.2 |
| Red Hat Enterprise Linux 9 | emacs-debuginfo | 1:27.2-18.el9_8.2 |
| Red Hat Enterprise Linux 9 | emacs-debugsource | 1:27.2-18.el9_8.2 |
| Red Hat Enterprise Linux 9 | emacs-filesystem | 1:27.2-18.el9_8.2 |
| Red Hat Enterprise Linux 9 | emacs-lucid | 1:27.2-18.el9_8.2 |
| Red Hat Enterprise Linux 9 | emacs-lucid-debuginfo | 1:27.2-18.el9_8.2 |
| Red Hat Enterprise Linux 9 | emacs-nox | 1:27.2-18.el9_8.2 |
| Red Hat Enterprise Linux 9 | emacs-nox-debuginfo | 1:27.2-18.el9_8.2 |
| Rocky Linux 10 | emacs | 1:29.4-14.el10_2.3 |
| Rocky Linux 8 | emacs | 1:26.1-15.el8_10.2 |
| Rocky Linux 9 | emacs | 1:27.2-18.el9_8.2 |
| SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS | emacs | 27.2-150400.3.31.2 |
| SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS | emacs | 27.2-150400.3.31.2 |
| SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS | emacs | 27.2-150400.3.31.2 |
| SUSE Linux Enterprise High Performance Computing 15 SP5-LTSS | emacs | 27.2-150400.3.31.2 |
| SUSE Linux Enterprise Module for Basesystem 15 SP7 | emacs | 27.2-150400.3.31.2 |
| SUSE Linux Enterprise Module for Desktop Applications 15 SP7 | emacs | 27.2-150400.3.31.2 |
| SUSE Linux Enterprise Server 12 SP5-LTSS | emacs | 24.3-25.26.1 |
| SUSE Linux Enterprise Server 15 SP4-LTSS | emacs | 27.2-150400.3.31.2 |
| SUSE Linux Enterprise Server 15 SP5-LTSS | emacs | 27.2-150400.3.31.2 |
| SUSE Linux Enterprise Server 15 SP6-LTSS | emacs | 27.2-150400.3.31.2 |
| SUSE Linux Enterprise Server 16.0 | emacs | 30.2-160000.3.1 |
| SUSE Linux Enterprise Server LTSS Extended Security 12 SP5 | emacs | 24.3-25.26.1 |
| SUSE Linux Enterprise Server for SAP Applications 15 SP4 | emacs | 27.2-150400.3.31.2 |
| SUSE Linux Enterprise Server for SAP Applications 15 SP5 | emacs | 27.2-150400.3.31.2 |
| SUSE Linux Enterprise Server for SAP Applications 15 SP6 | emacs | 27.2-150400.3.31.2 |
| SUSE Linux Enterprise Server for SAP applications 16.0 | emacs | 30.2-160000.3.1 |
| Ubuntu 16.04 LTS | xemacs21 | no fix |
| Ubuntu 16.04 LTS | xemacs21-packages | no fix |
| Ubuntu 18.04 LTS | xemacs21 | no fix |
| Ubuntu 18.04 LTS | xemacs21-packages | no fix |
| Ubuntu 20.04 LTS | xemacs21 | no fix |
| Ubuntu 20.04 LTS | xemacs21-packages | no fix |
| Ubuntu 22.04 LTS | xemacs21 | no fix |
| Ubuntu 22.04 LTS | xemacs21-packages | no fix |
| Ubuntu 24.04 LTS | xemacs21 | no fix |
| Ubuntu 24.04 LTS | xemacs21-packages | no fix |
| Ubuntu 26.04 LTS | xemacs21 | no fix |
| Ubuntu 26.04 LTS | xemacs21-packages | no fix |
| Ubuntu 26.10 | emacs | no fix |
| Ubuntu 26.10 | xemacs21 | no fix |
| Ubuntu 26.10 | xemacs21-packages | no fix |
| Ubuntu Pro 16.04 LTS | emacs24 | no fix |
| Ubuntu Pro 18.04 LTS | emacs25 | no fix |
| Ubuntu Pro 20.04 LTS | emacs | no fix |
| Ubuntu Pro 22.04 LTS | emacs | no fix |
| Ubuntu Pro 24.04 LTS | emacs | no fix |
| Ubuntu Pro 26.04 LTS | emacs | no fix |
| openSUSE Leap 16.0 | emacs | 30.2-160000.3.1 |