https://seclists.org/oss-sec/2026/q4/155: Incomplete fix for Emacs CVE-2026-79992
Published Oct 14, 2026
·Updated
Affected Software
1 affected component
GNU Emacs
Frequently Asked Questions
1
What input is required for exploitation to remain possible?
The issue involves user names containing additional problematic characters that were not checked by tramp-user-regexp. The prior fix did not reject all such characters.
2
Which Emacs release will contain the correction?
The patch is planned for Emacs 31.2. That release was not expected soon at the time of the report.
3
What can be done before Emacs 31.2 is released?
An attached patch from the TRAMP maintainer addresses the problem. Applying that patch is the available remediation described in the report.
4
Is there a separate CVE identifier for this incomplete fix?
The report asks Red Hat to assign another CVE, but does not state that one had been assigned.