CVE-2026-96269: High severity GNU Emacs vulnerability
Published Sep 22, 2026
·Updated
GNU Emacs 28.1 through 31.1 allows arbitrary code execution upon opening a file, because an untrusted value of read-symbol-shorthands affects the intern and unintern functions. This affects the default configuration; no particular user settings are required to trigger it.
Affected Software
1 affected component
GNU Emacs>=28.1<=31.1
Event History
Sep 22, 2026
CVE Published
via MITRE·08:32 PM
Data Sourced
via MITRE·08:32 PM
DescriptionWeakness
Data Sourced
via NVD·09:17 PM
DescriptionSeverityWeakness
Frequently Asked Questions
1
Which deployments are affected by this issue?
GNU Emacs versions 28.1 through 31.1 are affected. The issue affects the default configuration, so no custom user settings are needed.
2
What must an attacker do to trigger exploitation?
An attacker needs a target to open a file containing an untrusted read-symbol-shorthands value. Opening that file can result in arbitrary code execution.