On 8/19/26 23:09, Sam James wrote: > Eshel Yaron has shared an arbitrary code execution bug in GNU Emacs > exploitable upon opening an file. It affects >= Emacs 28.1. > > The reporter has a writeup at > https://eshelyaron.com/posts/2026-08-06-emacs-arbitrary-code-execution-returns.html. > It's from the same reporter as CVE-2024-53920 [0]. > > Thread on emacs-devel: > * https://lists.gnu.org/archive/html/emacs-devel/2026-07/msg00453.html > * https://lists.gnu.org/archive/html/emacs-devel/2026-08/msg00000.html > > There's a workaround patch available for Emacs 31 > (https://cgit.git.savannah.gnu.org/cgit/emacs.git/commit/?h=emacs-31&id=8466eb44991707d128110bdc549fad14c8e1d61e) > while on master it apparently had a bigger rework > (https://cgit.git.savannah.gnu.org/cgit/emacs.git/commit/?id=c1337758a6c00e22e2a685e0556068fd73fa9a54). > > In Gentoo, we backported the fix [1] down to 28.2. > > [0] https://www.openwall.com/lists/oss-security/2025/02/26/2 > [1] https://bugs.gentoo.org/980616 > > thanks, > sam
Disabling file-local variables seems to be an alternative mitigation, and the one I recommend. I would not be surprised if LLMs start popping out lots of 0day exploits in Emacs. -- Sincerely, Demi Marie Obenour (she/her/hers)
OpenPGP_signature.asc
Description: OpenPGP digital signature
