CVE-2026-6861: Emacs: emacs: memory corruption vulnerability when processing svg css
A flaw was found in GNU Emacs. This vulnerability, a memory corruption issue, occurs when Emacs processes specially crafted SVG (Scalable Vector Graphics) CSS (Cascading Style Sheets) data. A local user could exploit this by convincing a victim to open a malicious SVG file, which may lead to a denial of service (DoS) or potentially information disclosure.
Other sources
Emacs: emacs: memory corruption vulnerability when processing svg css
— Microsoft
Off-by-one heap buffer overflow and uninitialized heap read in GNU Emacs src/image.c svgloadimage() when processing SVG CSS. The null terminator is written one byte past the allocation. Affected: Emacs 28.1 through 30.2. Fixed upstream on emacs-30: commit 8f535370b9.
Public bug: https://debbugs.gnu.org/cgi/bugreport.cgi?bug=80851
— Red Hat
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
GNU Emacsto a version that resolves this vulnerability.Fixed in emacs-30Patch 8f535370b9 - Compensating control
Mitigate exploitation by preventing users from opening untrusted/malicious SVG files in GNU Emacs (e.g., disable or block opening of externally sourced SVG content).
Event History
Frequently Asked Questions
What is the severity of CVE-2026-6861?
CVE-2026-6861 has been classified with a severity rating that indicates it poses a significant security risk due to potential memory corruption.
How do I fix CVE-2026-6861?
To resolve CVE-2026-6861, users should update to the latest version of GNU Emacs that addresses this memory corruption vulnerability.
Who is affected by CVE-2026-6861?
CVE-2026-6861 affects local users of GNU Emacs versions between 28.1 and 30.2 who process specially crafted SVG CSS data.
What kind of vulnerability is CVE-2026-6861?
CVE-2026-6861 is a memory corruption vulnerability that occurs during the handling of SVG CSS in GNU Emacs.
Can CVE-2026-6861 be exploited remotely?
CVE-2026-6861 requires local exploitation, meaning an attacker needs access to the affected system to exploit this vulnerability.