OESA-2026-4648: emacs security update

Q: What access does an attacker need to exploit this issue?

The vulnerability is locally exploitable and requires low privileges. No user interaction is required, and exploitation involves a crafted filename that leads to OS command injection.

Q: Which installations should be considered affected?

GNU Emacs versions before 31.2 are affected. The advisory also identifies TRAMP through version 2.8.2 as affected.

Q: How can I check whether a system needs remediation?

Determine the installed GNU Emacs version and the installed TRAMP version. Systems running Emacs earlier than 31.2 or TRAMP 2.8.2 or earlier should be treated as affected.

Published Oct 29, 2026

Updated

Emacs is the extensible, customizable, self-documenting real-time display editor. At its core is an interpreter for Emacs Lisp, a dialect of the Lisp programming language with extensions to support text editing. And it is an entire ecosystem of functionality beyond text editing, including a project planner, mail and news reader, debugger interface, calendar, and more. Security Fix(es):

GNU Emacs before 31.2 (and TRAMP through 2.8.2) allows OS command injection via a filename because tramp-user-regexp has an incomplete list of disallowed inputs. NOTE: this issue exists because of an incomplete fix for CVE-2026-79992.(CVE-2026-108976)

Affected Software

1 affected componentFixes available

openeuler/emacs<29.1-11.oe2403sp1

29.1-11.oe2403sp1

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade openeuler/emacs to a version that resolves this vulnerability.
Fixed in 29.1-11.oe2403sp1
Upgrade
Upgrade GNU Emacs to a version that resolves this vulnerability.
Fixed in 31.2

Event History

Oct 29, 2026

Advisory Published

via OSV·09:04 AM

Data Sourced

via OSV·09:04 AM

DescriptionSeverityAffected Software

Child vulnerabilities

Contains the following vulnerabilities.

CVE-2026-108976

Frequently Asked Questions

What access does an attacker need to exploit this issue?

The vulnerability is locally exploitable and requires low privileges. No user interaction is required, and exploitation involves a crafted filename that leads to OS command injection.

Which installations should be considered affected?

GNU Emacs versions before 31.2 are affected. The advisory also identifies TRAMP through version 2.8.2 as affected.

How can I check whether a system needs remediation?

Determine the installed GNU Emacs version and the installed TRAMP version. Systems running Emacs earlier than 31.2 or TRAMP 2.8.2 or earlier should be treated as affected.

OESA-2026-4648: emacs security update

Affected Software

Remediation

Event History

Child vulnerabilities

Frequently Asked Questions

What access does an attacker need to exploit this issue?

Which installations should be considered affected?

How can I check whether a system needs remediation?

Company

Resources

Contact

Frequently Asked Questions

What access does an attacker need to exploit this issue?

Which installations should be considered affected?

How can I check whether a system needs remediation?