CVE-2026-96442: Emacs: emacs: arbitrary code execution, incomplete fix for cve-2024-53920
A code execution flaw was found in Emacs, affecting versions prior to 31.2. The Flymake mode using language backends other than Lisp would execute arbitrary code from the edited file while performing syntax checking. Viewing or editing untrusted files using Emacs could lead to arbitrary code execution with the privileges of the user running Emacs.
Other sources
Emacs upstream reports:
Bas Alberts of the GitHub Security Lab discovered that the fix for CVE-2024-53920, an arbitrary code execution flaw in Emacs, was incomplete. Viewing or editing untrusted text files in modes other than Emacs Lisp mode can also permit arbitrary code execution. For example:
#!/usr/bin/perl # -- mode: perl; mode: flymake -- BEGIN { system("touch uhoh.txt"); }
This problem affects all Emacs versions affected by CVE-2024-53920. This means Emacs 24 and newer, and possibly also older versions.
A minimal fix, attached, is queued up for release with Emacs 31.2. We (the Emacs upstream maintainers) don't expect to backport the fix to older Emacs releases ourselves.
Source: https://www.openwall.com/lists/oss-security/2026/09/14/1
Upstream commit - emacs-31 branch: https://github.com/emacs-mirror/emacs/commit/abc802ee2eb0b1663349ddf22a461f8e54a383fb
Upstream commit - master branch: https://github.com/emacs-mirror/emacs/commit/135e6f63f08fee3d374fa1a5187bce941a2d3e3c
— Red Hat
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Emacsto a version that resolves this vulnerability.Fixed in 31.2
Event History
Frequently Asked Questions
Which installations should be treated as affected?
Emacs versions before 31.2 are affected. Upstream states that all versions affected by CVE-2024-53920 are in scope, including Emacs 24 and newer, with older versions possibly affected as well.
What must happen for an attacker to trigger code execution?
A user must view or edit an untrusted text file in a mode other than Emacs Lisp mode where Flymake uses a non-Lisp language backend. File content and mode declarations can cause code to run during syntax checking.
What access does executed code receive?
The code executes with the privileges of the user running Emacs. An attacker does not need pre-existing privileges in Emacs, but user interaction with the malicious file is required.
What should teams do if they cannot immediately upgrade?
Avoid viewing or editing untrusted files in Emacs, particularly files that may select non-Lisp major modes and invoke Flymake syntax checking. The upstream minimal fix is queued for Emacs 31.2, and upstream does not expect to backport it to older releases.