GNU Emacs CVE-2026-96269

Requires the victim to open an attacker-supplied file in GNU Emacs versions 28.1 through 31.1; no non-default settings are needed because the flaw affects the default configuration via an untrusted read-symbol-shorthands value influencing the intern/unintern functions. The limiting factor is delivery and interaction: the attacker must get the victim to open the crafted file (local file vector, AV:L), and exploitation is bounded to the privileges of the user running Emacs. No network service, listener, or authentication is involved, and no in-the-wild exploitation is evidenced.

This is a genuine high-priority flaw despite modest signals. The core danger: arbitrary code execution simply from opening a file, in the DEFAULT configuration with no special user settings required, across a wide version band (Emacs 28.1-31.1). The vendor/MITRE CVSS 4.0 vector (AV:L/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H) yields 7.5 with full CIA impact. Two vector points warrant scrutiny: the description says exploitation occurs 'upon opening a file,' which is user interaction, yet the vector sets UI:N - the malicious-file requirement appears to have been folded into AT:P (attack requirement present) instead of UI, so verify the interaction assumption with the vendor. AV:L is appropriate because the trigger is a locally opened file rather than a remote network request. No EPSS score, no CISA KEV listing, and no public POC were provided, so there is no evidence of active or automated exploitation at this time - the risk is driven by ease of the underlying primitive (untrusted read-symbol-shorthands corrupting intern/unintern) and default-config exposure, not by observed in-the-wild activity. Net: a real code-execution bug that developers who open untrusted files/repos should patch promptly, but currently 'attacker must get you to open a file' rather than mass-exploitable.

An attacker crafts a malicious source or text file that embeds an untrusted read-symbol-shorthands value; when a victim opens the file in a default Emacs (28.1-31.1) installation, the poisoned value influences the intern/unintern functions and executes attacker-controlled code in the victim's session. Delivery is realistic via a shared repository, email attachment, or downloaded project that a developer opens. No public exploit code was identified at time of analysis.