Executive brief
GNU Emacs is a text editor used for writing and editing code. A vulnerability allows attackers to execute arbitrary code when a user opens a file, by manipulating the symbol shorthand settings. No special configuration or user action beyond opening a file is required for exploitation.
Technical details
The vulnerability occurs in the intern and unintern functions, which respect the read-symbol-shorthands buffer-local variable during symbol name resolution. An untrusted value of read-symbol-shorthands in a crafted file can cause the functions to resolve symbol names differently than intended, allowing code execution. The default Emacs configuration is affected without requiring explicit user settings.
Affected products
- GNU Emacs 28.1 through 31.1
Timeline
- 2026-09-22: disclosed
- 2026-03-08: other: Bug reported upstream