{"id":"CVE-2026-96269","title":"GNU Emacs 28.1 through 31.1 allows arbitrary code execution upon opening a file, because an untrusted value of read-symbol-shorthands affects the intern and unintern functions","summary":"GNU Emacs 28.1 through 31.1 allows arbitrary code execution upon opening a file, because an untrusted value of read-symbol-shorthands affects the intern and unintern functions. This affects the default configuration; no particular user s…","severity":"high","cvss":7.5,"cvssVector":"CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","cwe":["CWE-829"],"vendor":"GNU","product":"Emacs","affected":["Emacs >= 28.1 <= 31.1"],"published":"2026-09-22","updated":"2026-09-24","sourceUpdated":"2026-09-24T02:16:53.383","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-96269","references":[{"url":"https://debbugs.gnu.org/cgi/bugreport.cgi?bug=80574#227","label":"cve@mitre.org"},{"url":"https://yhetil.org/emacs/jwvtsph1aoj.fsf-monnier+emacs@gnu.org/T/#m319545e835fb71d764bf868166632d4633167a75","label":"cve@mitre.org"},{"url":"https://eshelyaron.com/posts/2026-08-06-emacs-arbitrary-code-execution-returns.html","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://www.openwall.com/lists/oss-security/2026/08/20/3","label":"af854a3a-2127-422b-91ae-364da2661108"}],"tags":["nvd","cve.org"],"ssvc":{"exploitation":"none","automatable":"no","technicalImpact":"total","timestamp":"2026-09-22T20:47:44.364030Z"},"cvssSource":"cna","epss":0.00184,"epssPercentile":0.0822,"ingestedAt":"2026-09-22T21:11:40.321Z","slug":"CVE-2026-96269","body":"## Overview\n\nGNU Emacs 28.1 through 31.1 allows arbitrary code execution upon opening a file, because an untrusted value of read-symbol-shorthands affects the intern and unintern functions. This affects the default configuration; no particular user settings are required to trigger it.\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"twilight","depthScore":41,"depthScoreParts":{"impact":41.3,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}