Executive brief
GNU Emacs includes a built-in image viewer that opens and displays images in various formats. A vulnerability in the PBM/PPM/PGM image loader allows an attacker to craft a malicious image file that, when opened by a user (via file browser, email client, or web browser integration), causes Emacs to read sensitive data from memory and display it. This could leak private information such as encryption keys, passwords, or other confidential data stored in the application's memory.
Technical details
The vulnerability is an integer overflow in the PBM/PPM/PGM image loader in src/image.c. The loader calculates the expected pixel buffer size using 32-bit signed integer arithmetic (height * width * channels), which wraps to a negative value when given large dimensions (e.g., 20000x18000 pixels). The negative result bypasses the bounds check, allowing the subsequent pixel-reading loop to read past the allocated heap buffer without bounds validation. An attacker can trigger this by supplying a crafted image file; the vulnerability is reachable through multiple attack vectors including direct file opening, the built-in web browser (eww), email reader (Gnus), and inline image rendering in Org documents. A fix was committed to the Emacs repository (commit b07e634) that avoids the integer overflow by using proper size calculations.
Affected products
- GNU Emacs before 31.0.91
Timeline
- 2026-07-02: disclosed: Vulnerability reported to GNU bug tracker by Tristan Madani
- 2026-08: patched: Fix committed to Emacs repository (commit b07e634) by Paul Eggert