https://seclists.org/oss-sec/2026/q3/751: Emacs arbitrary code execution: incomplete fix for CVE-2024-53920
Affected Software
Frequently Asked Questions
Who is exposed to this issue?
Users who view or edit untrusted text files in Emacs modes other than Emacs Lisp mode may be exposed. The issue affects Emacs 24 and newer versions affected by CVE-2024-53920, and possibly older versions as well.
What must an attacker provide to trigger code execution?
An attacker needs to convince a user to view or edit a crafted untrusted text file that selects a mode and contains code executed through that mode's processing. The example uses Perl mode with the Flymake mode enabled and a Perl BEGIN block.
Is a fix available for currently supported older Emacs releases?
A minimal fix is queued for Emacs 31.2. Upstream does not expect to backport the fix to older Emacs releases themselves.
What can be done if upgrading is not immediately possible?
Avoid viewing or editing untrusted text files in Emacs modes that can invoke language-specific processing, including Flymake-related backends. The proposed minimal fix generalizes trusted-content checks to all Flymake backends; it also temporarily disables the Eglot Flymake backend.