https://seclists.org/oss-sec/2026/q3/524: GNU Emacs vulnerability upon opening arbitrary file
Published Aug 20, 2026
·Updated
Affected Software
1 affected component
GNU Emacs>=undefined
Frequently Asked Questions
1
What must an attacker do to exploit this issue?
The attacker needs to persuade or cause a user to open an arbitrary file in GNU Emacs. Opening that file can result in arbitrary code execution.
2
Which GNU Emacs versions should be considered affected?
The report states that GNU Emacs versions 28.1 and later are affected. Fixed or mitigated builds may exist where distributors have backported changes, so package-specific patch status should also be checked.
3
What options are available if an update is not immediately possible?
Avoid opening untrusted or attacker-supplied files in Emacs until a fix is available. A workaround patch is available for the Emacs 31 branch; the master branch received a larger rework.
4
Is a fix available for Gentoo users?
Gentoo has backported the fix to version 28.2. Users should verify the status of their installed Gentoo package against the distribution's update information.