# CVE-2026-96269: GNU Emacs arbitrary code execution in symbol handling

Source: https://junglewise.ai/threats/cve-2026-96269-gnu-emacs-28-1-through-31-1-allows-arbitrary-code-execution-upon  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-09-22. Updated: 2026-09-26  
License: CC BY 4.0 with a link back

CVE-2026-96269 · Severity: info · Published 2026-09-22

GNU Emacs is a text editor used for writing and editing code. A vulnerability allows attackers to execute arbitrary code when a user opens a file, by manipulating the symbol shorthand settings. No special configuration or user action beyond opening a file is required for exploitation.

Technologies: [Gnu Emacs](https://junglewise.ai/threats/technologies/emacs). Vendors: [Gnu](https://junglewise.ai/threats/vendors/gnu).

## Quick answers

**Is CVE-2026-96269 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-96269 being exploited in the wild.

**How severe is CVE-2026-96269?** Informational severity, published 22 September 2026.

**Which products and versions are affected?** Gnu Emacs 28.1 through 31.1.

**Is there a fix for CVE-2026-96269?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-96269 attacked?** It is attacked with local access, in a software library.

**Am I affected by CVE-2026-96269?** Check whether you run Gnu Emacs at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The vulnerability occurs in the intern and unintern functions, which respect the read-symbol-shorthands buffer-local variable during symbol name resolution. An untrusted value of read-symbol-shorthands in a crafted file can cause the functions to resolve symbol names differently than intended, allowing code execution. The default Emacs configuration is affected without requiring explicit user settings.

## Affected products

- GNU Emacs 28.1 through 31.1

## Timeline

- 2026-09-22: disclosed
- 2026-03-08: other: Bug reported upstream

## References

- [https://debbugs.gnu.org/cgi/bugreport.cgi?bug=80574](https://debbugs.gnu.org/cgi/bugreport.cgi?bug=80574)
- [https://yhetil.org/emacs/jwvtsph1aoj.fsf-monnier+emacs@gnu.org/T/](https://yhetil.org/emacs/jwvtsph1aoj.fsf-monnier+emacs@gnu.org/T/)

## Related threats

- [GNU Emacs command injection via TRAMP user field in filename](https://junglewise.ai/threats/cve-2026-108976-gnu-emacs-before-31-2-and-tramp-through-2-8-2-allows-os-command)
- [Emacs Flymake code execution via untrusted files](https://junglewise.ai/threats/cve-2026-96442-a-code-execution-flaw-was-found-in-emacs-affecting-versions-prior)
- [Emacs TRAMP command injection via malicious filenames](https://junglewise.ai/threats/cve-2026-79992-emacs-tramp-command-injection-via-malicious-filenames)
- [GNU Emacs integer overflow in PBM image loader](https://junglewise.ai/threats/cve-2026-77219-gnu-emacs-integer-overflow-in-pbm-image-loader)
- [GNU Emacs for Android improper validation in font table parsing](https://junglewise.ai/threats/cve-2026-71394-gnu-emacs-for-android-improper-validation-in-font-table-parsing)