Bug 2537347 (CVE-2026-96442)

Summary: CVE-2026-96442 emacs: Emacs: arbitrary code execution in Flymake mode
Product: [Other] Security Response Reporter: OSIDB Bzimport <bzimport>
Component: vulnerabilityAssignee: Product Security DevOps Team <prodsec-dev>
Status: NEW --- QA Contact:
Severity: high Docs Contact:
Priority: high    
Version: unspecifiedCC: rhel-process-autobot, watson-tool-maintainers
Target Milestone: ---Keywords: Security
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: Doc Type: ---
Doc Text:
A code execution flaw was found in Emacs, affecting versions prior to 31.2. The Flymake mode using language backends other than Lisp would execute arbitrary code from the edited file while performing syntax checking. Viewing or editing untrusted files using Emacs could lead to arbitrary code execution with the privileges of the user running Emacs.
 Story Points: ---
Clone Of: Environment:
Last Closed: Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:
Bug Depends On: 2537390    
Bug Blocks:    

Description OSIDB Bzimport 2026-09-21 09:47:33 UTC 
Emacs upstream reports:

Bas Alberts of the GitHub Security Lab discovered that the fix for
CVE-2024-53920, an arbitrary code execution flaw in Emacs, was
incomplete.  Viewing or editing untrusted text files in modes other than
Emacs Lisp mode can also permit arbitrary code execution.  For example:

    #!/usr/bin/perl
    # -*- mode: perl; mode: flymake -*-
    BEGIN { system("touch uh_oh.txt"); }

This problem affects all Emacs versions affected by CVE-2024-53920.
This means Emacs 24 and newer, and possibly also older versions.

A minimal fix, attached, is queued up for release with Emacs 31.2.
We (the Emacs upstream maintainers) don't expect to backport the fix to
older Emacs releases ourselves.

Source:
https://www.openwall.com/lists/oss-security/2026/09/14/1

Upstream commit - emacs-31 branch:
https://github.com/emacs-mirror/emacs/commit/abc802ee2eb0b1663349ddf22a461f8e54a383fb

Upstream commit - master branch:
https://github.com/emacs-mirror/emacs/commit/135e6f63f08fee3d374fa1a5187bce941a2d3e3c