GNU Emacs: Arbitrary code execution — GLSA 202608-18

A vulnerability has been discovered in GNU Emacs which could lead to arbitrary code execution.

Affected packages

Package	app-editors/emacs on all architectures
Affected versions	< 28.2-r21 < 29.4-r9 < 30.2-r5
Unaffected versions	>= 28.2-r21 >= 29.4-r9 >= 30.2-r5 < 28

Background

GNU Emacs is the extensible, customizable, self-documenting real-time display editor.

Description

A vulnerability has been discovered in GNU Emacs. Please review the CVE identifier referenced below for details.

Impact

An attacker could achieve arbitrary code execution by tricking a user into opening a file with malicious content. No other action by the user is required.

Workaround

Avoid opening any untrusted files.

Resolution

All GNU Emacs 28 users should upgrade to the latest version:

 # emerge --sync
 # emerge --ask --oneshot --verbose ">=app-editors/emacs-28.2-r21:28"

All GNU Emacs 29 users should upgrade to the latest version:

 # emerge --sync
 # emerge --ask --oneshot --verbose ">=app-editors/emacs-29.4-r9:29"

All GNU Emacs 30 users should upgrade to the latest version:

 # emerge --sync
 # emerge --ask --oneshot --verbose ">=app-editors/emacs-30.2-r5:30"

References

Release date
August 20, 2026

Latest revision
August 20, 2026: 4

Severity
high

Exploitable
remote

Bugzilla entries

980616