CVE-2026-96269: 
Emacs vulnerability analysis and mitigation

CVE-2026-96269 is an arbitrary code execution vulnerability in GNU Emacs 28.1 through 31.1, triggered when a user opens a specially crafted file. The flaw exists because an untrusted value of read-symbol-shorthands can influence the intern and unintern functions, enabling code injection without any special user configuration. It was published on September 22, 2026, with a researcher blog post and oss-security disclosure preceding the CVE assignment (GitHub Advisory, Red Hat Bugzilla). The vulnerability carries a CVSS v3.1 base score of 7.8 (High) and a CVSS v4.0 base score of 7.5 (High) (GitHub Advisory).

The root cause is classified under CWE-829 (Inclusion of Functionality from Untrusted Control Sphere) and CWE-94 (Improper Control of Generation of Code), reflecting that Emacs improperly trusts file-local variable values for read-symbol-shorthands (GitHub Advisory). The read-symbol-shorthands feature, introduced in Emacs 28.1, allows Elisp files to define shorthand aliases for symbol names; when Emacs reads such a file, the untrusted shorthand mappings are applied during symbol interning via intern/unintern, which can be abused to redirect symbol lookups to attacker-controlled code. Exploitation requires only that a victim open a maliciously crafted file in Emacs — no elevated privileges or non-default settings are needed. A researcher blog post and GNU bug tracker discussion provide additional technical context (Red Hat Bugzilla).

Successful exploitation grants an attacker arbitrary code execution with the full privileges of the user running Emacs, impacting confidentiality, integrity, and availability at a high level (GitHub Advisory). Because Emacs is commonly run interactively by developers and system administrators, exploitation could expose sensitive credentials, source code, SSH keys, and other data accessible to the user. Depending on the user's privilege level, successful exploitation could also facilitate lateral movement within a network or privilege escalation on the local system.

As of the time of disclosure, there is no public proof-of-concept exploit and no confirmed in-the-wild exploitation (GitHub Advisory). The EPSS score is approximately 0.18% (3rd percentile), indicating a currently low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. The attack requires user interaction (opening a malicious file) but no privileges, making social engineering a plausible delivery vector.

1. Craft a malicious Emacs Lisp file: Create a file containing a read-symbol-shorthands file-local variable that maps a commonly used symbol (e.g., a standard library function) to an attacker-controlled symbol or expression, embedding malicious Elisp code that will execute when the symbol is interned.
2. Deliver the file to the target: Use social engineering, phishing, a malicious repository, or a supply chain attack to get the victim to open the crafted file in GNU Emacs 28.1–31.1.
3. Trigger file opening: When the victim opens the file in Emacs (e.g., via find-file, drag-and-drop, or command-line invocation), Emacs processes the file-local read-symbol-shorthands variable.
4. Exploit symbol interning: Emacs applies the untrusted shorthand mappings during parsing, causing intern/unintern to resolve symbols in a way that executes the attacker's embedded Elisp payload.
5. Achieve code execution: The malicious Elisp code runs with the privileges of the Emacs process, enabling actions such as exfiltrating files, establishing a reverse shell, or dropping persistent payloads (GitHub Advisory, Red Hat Bugzilla).

• File System: Unexpected or newly created files in the user's home directory, /tmp, or Emacs configuration directories (e.g., ~/.emacs.d/) following the opening of an untrusted file; presence of files with embedded read-symbol-shorthands local variable blocks containing unusual symbol mappings.
• Process: Unusual child processes spawned by the Emacs process (e.g., bash, sh, curl, wget, python, nc) that are not typical for normal Emacs usage.
• Network: Unexpected outbound network connections originating from the Emacs process or its children to unknown external IP addresses or domains.
• Logs: Shell history or audit logs showing commands executed shortly after Emacs opened a specific file; auditd records of execve calls from the Emacs process spawning unexpected binaries.

Users should update GNU Emacs to a version newer than 31.1 once a patched release is available from the GNU project (GitHub Advisory). As an interim workaround, avoid opening files from untrusted or unknown sources in Emacs, and consider disabling or restricting file-local variable processing by setting enable-local-variables to nil or :safe in your Emacs configuration. Red Hat has acknowledged the vulnerability and is tracking it via their security response process (Red Hat Bugzilla).

Researcher Eshel Yaron published a blog post on August 6, 2026, detailing the vulnerability and its mechanics, which was referenced in the Red Hat Bugzilla report and served as the primary technical disclosure (Red Hat Bugzilla). The issue was also discussed on the oss-security mailing list in August 2026, prior to the formal CVE assignment in September 2026. Community reaction has been moderate, with the vulnerability noted as a recurrence of a class of Emacs file-local variable abuse issues.