https://seclists.org/oss-sec/2026/q3/855: Emacs arbitrary code execution: incomplete fix for CVE-2024-53920

Q: Which installations should be treated as potentially exposed?

All Emacs versions affected by CVE-2024-53920 are affected, including Emacs 24 and newer. Older versions may also be affected.

Q: What attacker-controlled content is needed to trigger code execution?

A user must view or edit an untrusted text file in a mode other than Emacs Lisp mode. The example uses a file-local mode declaration to select Perl and Flymake, with Perl code that executes a system command.

Q: Are upstream fixes planned for maintained older releases?

Upstream maintainers do not expect to backport the fix to older Emacs releases themselves. A minimal fix is queued for Emacs 31.2.

Q: Does the currently queued fix have operational side effects?

The queued minimal fix implicitly disables the Eglot Flymake backend. The maintainers expect they may be able to undo that behavior before Emacs 31.2 is released.

Published Sep 21, 2026

Updated

Affected Software

1 affected component

GNU Emacs>=<=

Frequently Asked Questions

Which installations should be treated as potentially exposed?

All Emacs versions affected by CVE-2024-53920 are affected, including Emacs 24 and newer. Older versions may also be affected.

What attacker-controlled content is needed to trigger code execution?

A user must view or edit an untrusted text file in a mode other than Emacs Lisp mode. The example uses a file-local mode declaration to select Perl and Flymake, with Perl code that executes a system command.

Are upstream fixes planned for maintained older releases?

Upstream maintainers do not expect to backport the fix to older Emacs releases themselves. A minimal fix is queued for Emacs 31.2.

Does the currently queued fix have operational side effects?

The queued minimal fix implicitly disables the Eglot Flymake backend. The maintainers expect they may be able to undo that behavior before Emacs 31.2 is released.