CVE-2026-79992: 
Emacs vulnerability analysis and mitigation

CVE-2026-79992 is a local OS command injection vulnerability in GNU Emacs's TRAMP (Transparent Remote Access, Multiple Protocol) component. A local attacker can exploit this flaw by causing Emacs to process a maliciously crafted filename, as TRAMP concatenates login arguments without proper sanitization before passing them to a local shell, enabling arbitrary code execution. The vulnerability was discovered by Bas Alberts of the GitHub Security Lab and was publicly disclosed on August 25–26, 2026, with CVE assignment credited to Marco Benatto (Openwall oss-sec, Red Hat Advisory). It carries a CVSS v3.1 base score of 7.8 (High) (GitHub Advisory).

The root cause is CWE-78 (Improper Neutralization of Special Elements used in an OS Command), specifically within Emacs TRAMP's handling of the user/login field when constructing shell commands (Red Hat Advisory, GitHub Advisory). TRAMP concatenates login arguments — including user-controlled data such as filenames or usernames — directly into a shell command string without sanitizing shell metacharacters, allowing injection of arbitrary shell commands (Red Hat Bugzilla). Exploitation requires the victim to open or process a maliciously crafted filename within Emacs, making this a "zero-click" local attack in contexts where filenames can be attacker-influenced (e.g., shared filesystems, downloaded archives). The vulnerability affects GNU Emacs 30.2 onwards and possibly earlier versions (Openwall oss-sec).

Successful exploitation allows a local attacker with low privileges to execute arbitrary OS commands in the security context of the user running Emacs, resulting in high confidentiality, integrity, and availability impact (Red Hat Advisory). An attacker could read or modify sensitive files, install malware, establish persistence, or disrupt the Emacs process and dependent workflows. Because the injected commands run as the Emacs user, the attacker could potentially access any data or resources accessible to that user, and in multi-user environments, this could facilitate lateral movement or privilege escalation if the Emacs process has elevated permissions (GitHub Advisory).

There is no public proof-of-concept exploit code and no evidence of in-the-wild exploitation at this time (GitHub Advisory). The EPSS score is approximately 0.13% (3rd percentile), indicating a low near-term probability of exploitation (GitHub Advisory). The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation is not automatable and requires local access with low privileges, limiting the attack surface compared to remote vulnerabilities (Red Hat Advisory).

1. Reconnaissance: Identify systems where GNU Emacs 30.2 or later is installed and where TRAMP is used or enabled, particularly in shared or multi-user environments.
2. Craft malicious filename: Create a file with a specially crafted name containing shell metacharacters or injection sequences targeting TRAMP's login argument concatenation (e.g., a filename embedding characters like ;, $(), or backticks in a position that TRAMP would interpret as part of a login/user field).
3. Deliver the malicious file: Place the crafted file in a location the victim user is likely to open with Emacs — such as a shared directory, a downloaded archive, or a repository — exploiting the "zero-click" nature of the vulnerability when Emacs processes the filename.
4. Trigger exploitation: When the victim opens or browses to the malicious filename in Emacs (e.g., via dired, file completion, or TRAMP remote access), TRAMP processes the filename and passes the unsanitized login arguments to a local shell.
5. Achieve code execution: The injected shell commands execute in the context of the victim's Emacs process, enabling the attacker to run arbitrary commands, exfiltrate data, or establish persistence (Openwall oss-sec, Red Hat Advisory).

• Logs: Unexpected shell commands appearing in shell history or audit logs (auditd) attributed to the Emacs user process; unusual execve syscall events spawned from the Emacs process.
• Process: Unexpected child processes of the Emacs process (e.g., /bin/sh, /bin/bash, curl, wget, python, nc) visible via ps or process monitoring tools.
• File System: Newly created or modified files in the Emacs user's home directory or temp directories that are not expected from normal Emacs usage; unexpected cron jobs or .bashrc/.profile modifications under the Emacs user account.
• Network: Outbound network connections from the Emacs process to unexpected external hosts, particularly if TRAMP is not normally used for remote access.

A patch is available via the GitHub Advisory (GHSA-42vv-cfp2-9qc8), and distribution-specific updates have been released for Fedora 44, openSUSE, and SUSE Linux Enterprise (GitHub Advisory, openSUSE Advisory, SUSE Advisory). Users should update Emacs to the patched version provided by their distribution as the primary remediation. As a workaround, Red Hat recommends avoiding processing untrusted filenames or interacting with remote systems that may contain maliciously crafted filenames; disabling TRAMP functionality if it is not required is also an effective mitigation (Red Hat Advisory).

The vulnerability was reported to the oss-security mailing list by Sean Whitton, crediting Bas Alberts of the GitHub Security Lab as the discoverer (Openwall oss-sec). Red Hat classified the issue as "Important" severity and noted that exploitation requires user interaction with a malicious file, limiting remote exploitability (Red Hat Advisory). The vulnerability received coverage in Linux security roundup publications and German-language security news (pro-linux.de), and was tracked by Tenable Nessus plugins, indicating broad awareness in the Linux security community (Feedly).