CVE-2026-96269
Fixed in a distro release EPSS <1%CVSS 7.5
GNU Emacs 28.1 through 31.1 allows arbitrary code execution upon opening a file, because an untrusted value of read-symbol-shorthands affects the intern and unintern functions. This affects the default configuration; no particular user settings are required to trigger it.
Products: gnu emacs
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Debian 12 | emacs | no fix |
| Debian 13 | emacs | 1:30.1+1-6+deb13u1 |
| Debian 14 | emacs | 1:30.2+1-11 |
| Ubuntu 16.04 LTS | xemacs21 | no fix |
| Ubuntu 16.04 LTS | xemacs21-packages | no fix |
| Ubuntu 18.04 LTS | xemacs21 | no fix |
| Ubuntu 18.04 LTS | xemacs21-packages | no fix |
| Ubuntu 20.04 LTS | xemacs21 | no fix |
| Ubuntu 20.04 LTS | xemacs21-packages | no fix |
| Ubuntu 22.04 LTS | xemacs21 | no fix |
| Ubuntu 22.04 LTS | xemacs21-packages | no fix |
| Ubuntu 24.04 LTS | xemacs21 | no fix |
| Ubuntu 24.04 LTS | xemacs21-packages | no fix |
| Ubuntu 26.04 LTS | xemacs21 | no fix |
| Ubuntu 26.04 LTS | xemacs21-packages | no fix |
| Ubuntu 26.10 | emacs | no fix |
| Ubuntu 26.10 | xemacs21 | no fix |
| Ubuntu 26.10 | xemacs21-packages | no fix |
| Ubuntu Pro 16.04 LTS | emacs24 | no fix |
| Ubuntu Pro 18.04 LTS | emacs25 | no fix |
| Ubuntu Pro 20.04 LTS | emacs | no fix |
| Ubuntu Pro 22.04 LTS | emacs | no fix |
| Ubuntu Pro 24.04 LTS | emacs | no fix |
| Ubuntu Pro 26.04 LTS | emacs | no fix |