CVE-2026-96269: GNU Emacs Arbitrary Code Execution Vulnerability

CVE-2026-96269 Overview

GNU Emacs versions 28.1 through 31.1 contain an arbitrary code execution vulnerability triggered when a user opens a malicious file. The flaw resides in how Emacs processes the read-symbol-shorthands file-local variable, which influences the behavior of the intern and unintern functions. Because the vulnerability affects the default configuration, no special user settings or opt-ins are required for exploitation. An attacker who convinces a user to open a crafted file can execute arbitrary Emacs Lisp code with the privileges of the Emacs process. The issue is tracked under [CWE-829: Inclusion of Functionality from Untrusted Control Sphere].

Critical Impact
Opening a single untrusted file in an unpatched Emacs installation results in arbitrary code execution under the user's account.

Affected Products

GNU Emacs 28.1 through 31.1
Default Emacs configurations on all supported operating systems
Any workflow that opens files from untrusted sources (email attachments, cloned repositories, downloaded archives)

Discovery Timeline

2026-09-22 - CVE-2026-96269 published to NVD
2026-09-24 - Last updated in NVD database

Technical Details for CVE-2026-96269

Vulnerability Analysis

GNU Emacs supports file-local variables, which allow a file to declare buffer-local settings that Emacs applies when the file is opened. The read-symbol-shorthands variable defines symbol name rewrites used by the Lisp reader. When Emacs honors an untrusted value for this variable, the rewrite rules alter how intern and unintern resolve symbol names during file processing. Attackers abuse this behavior to redirect symbol interning toward Lisp forms that execute code at read time.

The vulnerability is exploitable in the default configuration. Users do not need to enable evaluation of file-local variables or lower any security settings for the attack to succeed. See Eshley Aron's Emacs Analysis for a detailed writeup.

Root Cause

The root cause is improper trust in file-local variable values. Emacs treats read-symbol-shorthands as safe input, but the variable directly influences the Lisp reader. Because reading Lisp forms can trigger side effects through symbol resolution, an attacker-controlled shorthands list transforms passive file parsing into code execution. The maintainers discuss the fix in GNU Bug Report #80574.

Attack Vector

Exploitation requires local file access by the victim. An attacker delivers a crafted file through email, source repositories, shared filesystems, or downloaded archives. When the user opens the file in Emacs, the reader applies the malicious read-symbol-shorthands rules and executes attacker-supplied Lisp. See the Openwall OSS Security Post for additional attack scenarios discussed on the disclosure list.

// No verified public exploit code is available at time of publication.
// Technical mechanism: a crafted file specifies a file-local
// read-symbol-shorthands value that redirects symbol interning
// during Lisp reading, resulting in arbitrary code execution.

Detection Methods for CVE-2026-96269

Indicators of Compromise

Files containing read-symbol-shorthands declarations within -*- ... -*- file-local variable blocks or Local Variables: sections
Unexpected child processes spawned by the emacs binary shortly after a file is opened
New or modified files under ~/.emacs.d/ or ~/.config/emacs/ on hosts where users recently opened untrusted content

Detection Strategies

Scan repositories, mail spools, and shared file stores for the string read-symbol-shorthands inside file-local variable regions
Alert on emacs process ancestry that launches shells, package managers, or network utilities
Correlate file open events in developer environments with subsequent outbound network connections initiated by the Emacs process

Monitoring Recommendations

Enable process execution telemetry on developer workstations and Linux servers where Emacs is installed
Log file access patterns for .el, .org, and source files delivered from external sources
Track Emacs version inventory across the fleet to prioritize hosts running versions 28.1 through 31.1

How to Mitigate CVE-2026-96269

Immediate Actions Required

Upgrade GNU Emacs to a patched release as soon as vendor packages become available for your distribution
Instruct users to avoid opening files from untrusted sources until the patch is applied
Audit shared repositories and mail archives for files containing read-symbol-shorthands in file-local variable sections

Patch Information

Refer to the upstream fix discussion in GNU Bug Report #80574 and the GNU Emacs Discussion Thread for the current status of patched builds. Apply distribution security updates as they are released for Emacs 28.x through 31.x branches.

Workarounds

Set enable-local-variables to nil to disable processing of file-local variables entirely, accepting the loss of legitimate functionality
Add read-symbol-shorthands to ignored-local-variables so Emacs refuses to honor the value from untrusted files
Open suspect files with --quick or in fundamental-mode without loading the user init file

bash

# Add to early-init.el or init.el to neutralize the attack surface
# until an official patch is installed:
(setq enable-local-variables nil)
(add-to-list 'ignored-local-variables 'read-symbol-shorthands)