GNU Emacs vulnerability upon opening arbitrary file

[Sam James <sam () gentoo org>]

Eshel Yaron has shared an arbitrary code execution bug in GNU Emacs
exploitable upon opening an file. It affects >= Emacs 28.1.

The reporter has a writeup at
https://eshelyaron.com/posts/2026-08-06-emacs-arbitrary-code-execution-returns.html.
It's from the same reporter as CVE-2024-53920 [0].

Thread on emacs-devel:
* https://lists.gnu.org/archive/html/emacs-devel/2026-07/msg00453.html
* https://lists.gnu.org/archive/html/emacs-devel/2026-08/msg00000.html

There's a workaround patch available for Emacs 31
(https://cgit.git.savannah.gnu.org/cgit/emacs.git/commit/?h=emacs-31&id=8466eb44991707d128110bdc549fad14c8e1d61e)
while on master it apparently had a bigger rework
(https://cgit.git.savannah.gnu.org/cgit/emacs.git/commit/?id=c1337758a6c00e22e2a685e0556068fd73fa9a54).

In Gentoo, we backported the fix [1] down to 28.2.

[0] https://www.openwall.com/lists/oss-security/2025/02/26/2
[1] https://bugs.gentoo.org/980616

thanks,
sam

Attachment: signature.asc
Description: