CVE-2026-77219: GNU Emacs Information Disclosure Flaw

CVE-2026-77219 Overview

CVE-2026-77219 is an integer overflow vulnerability in the PBM/PPM/PGM image loader of GNU Emacs before version 31.0.91. The flaw allows an attacker to leak heap memory contents by supplying a crafted image with large dimensions and an elevated max color index. The image loader multiplies image dimensions and channel count using signed integer arithmetic. For sufficiently large values, the result wraps to a negative number, bypassing the bounds check and causing the pixel reader to over-read heap memory past the allocated buffer. The over-read contents are then rendered on screen as pixel color values.

Critical Impact
Local attackers can trick users into opening a crafted PBM/PPM/PGM image in Emacs to leak adjacent heap memory contents, exposing sensitive in-process data.

Affected Products

GNU Emacs versions prior to 31.0.91
The PBM, PPM, and PGM image loader in src/image.c
Any downstream distribution or application shipping the affected Emacs image handling code

Discovery Timeline

2026-08-21 - CVE-2026-77219 published to NVD
2026-08-21 - Last updated in NVD database

Technical Details for CVE-2026-77219

Vulnerability Analysis

The vulnerability is an integer overflow [CWE-125] in the pbm_load function inside src/image.c. When parsing a portable bitmap image, Emacs computes the expected pixel buffer size by multiplying height, width, a two-byte channel factor, and a three-channel factor for PBM_COLOR images. The intermediate expected_size variable is a signed int, so multiplying large but individually plausible values wraps the product into a negative number.

A negative expected_size defeats the subsequent bounds check p + expected_size > end, allowing the pixel reader to proceed. The loader then reads past the end of the allocated input buffer and interprets adjacent heap bytes as pixel color values. Because those bytes are drawn to the display, an attacker with the ability to inspect the rendered image can reconstruct portions of Emacs heap memory.

Root Cause

The root cause is unchecked signed integer arithmetic on attacker-controlled dimensions. The original code performed expected_size = height * width followed by conditional multiplications without detecting overflow, then compared the wrapped result against the buffer end pointer. This is a classic size-calculation flaw where the sanity check runs after the overflow has already corrupted the value.

Attack Vector

Exploitation requires local access and user interaction: a victim must open a crafted PBM, PPM, or PGM image in Emacs. Delivery vectors include email attachments, shared repositories, or files rendered inline by Emacs modes that auto-preview images. Successful exploitation discloses heap memory but does not, on its own, provide code execution.

     }
   else
     {
-      int expected_size = height * width;
       bool two_byte = 255 < max_color_idx;
-      if (two_byte)
-	expected_size *= 2;
-      if (type == PBM_COLOR)
-	expected_size *= 3;
 
-      if (raw_p && p + expected_size > end)
+      if (raw_p)
 	{
-	  image_destroy_x_image (ximg);
-	  image_clear_image (f, img);
-	  image_error ("Invalid image size in image `%s'", img->spec);
-	  goto error;
+	  ptrdiff_t expected_size;
+	  bool bad = ckd_mul (&expected_size, height, width);
+	  bad |= ckd_mul (&expected_size, expected_size,
+			  (two_byte ? 2 : 1) * (type == PBM_COLOR ? 3 : 1));
+	  bad |= end - p < expected_size;
+	  if (bad)
+	    {
+	      image_destroy_x_image (ximg);
+	      image_clear_image (f, img);
+	      image_error ("Invalid image size in image `%s'", img->spec);
+	      goto error;
+	    }
 	}

Source: GitHub Commit b07e634 — the patch replaces raw signed multiplication with ckd_mul checked arithmetic and widens expected_size to ptrdiff_t, so any overflow sets the bad flag and rejects the image.

Detection Methods for CVE-2026-77219

Indicators of Compromise

PBM, PPM, or PGM files with unusually large width and height header values combined with an elevated max_color_idx.
Image files whose declared dimensions are inconsistent with the actual on-disk pixel data size.
Emacs process reads or renders images from untrusted directories, email spools, or newly cloned repositories.

Detection Strategies

Inspect PBM/PPM/PGM headers on ingest and flag files whose product of width * height * channels * bytes_per_channel overflows a 32-bit signed integer.
Compare the declared image size against the actual file size; large mismatches indicate a crafted header designed to trigger the over-read.
Track Emacs versions across managed endpoints and alert on hosts still running builds earlier than 31.0.91.

Monitoring Recommendations

Log Emacs invocations that open image files from user-writable download or attachment paths.
Monitor for repeated image_error messages referencing invalid image size, which may indicate probing attempts.
Alert on Emacs processes generating anomalous memory-read patterns via endpoint telemetry.

How to Mitigate CVE-2026-77219

Immediate Actions Required

Upgrade GNU Emacs to version 31.0.91 or later on all workstations and servers where users open untrusted content.
Rebuild and redistribute any internal Emacs packages or container images that bundle an older Emacs release.
Instruct users to avoid opening PBM, PPM, or PGM files received from untrusted sources until patches are applied.

Patch Information

The fix is upstream in commit b07e634 and shipped in the emacs-31.0.91 release. The patch replaces the vulnerable signed multiplication in pbm_load with ckd_mul checked arithmetic and stores the result in a ptrdiff_t, ensuring any overflow is detected before the bounds check. See the GitHub Release emacs-31.0.91, the GNU Bug Report #81344, and the VulnCheck Advisory for GNU Emacs for full details.

Workarounds

Disable automatic image display in Emacs by setting (setq-default display-images-p nil) or invoking Emacs with -nw for terminal-only sessions on untrusted content.
Remove or unregister PBM, PPM, and PGM handlers from image-type-file-name-regexps and image-type-header-regexps until the update is applied.
Restrict Emacs from opening files in directories that receive untrusted downloads, using filesystem ACLs or MAC policies.

bash

# Verify the installed Emacs version is patched
emacs --version | head -n1

# Debian/Ubuntu
sudo apt update && sudo apt install --only-upgrade emacs

# Fedora/RHEL
sudo dnf upgrade emacs

# macOS (Homebrew)
brew update && brew upgrade emacs

# Temporary hardening: disable inline image rendering
echo '(setq-default display-images-p nil)' >> ~/.emacs.d/init.el