Skip to main content

GNU Emacs EUVDEUVD-2026-64138

| CVE-2026-77219 MEDIUM
Integer Overflow or Wraparound (CWE-190)
2026-08-21 VulnCheck GHSA-q8pr-2495-3jw7
Integer Overflow Information Disclosure Emacs
6.9
CVSS 4.0 · Vendor: VulnCheck
Share

Severity by source

Vendor (VulnCheck) PRIMARY
6.9 MEDIUM
CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
vuln.today AI
7.1 HIGH

AV:L because user must open a local file; UI:R for mandatory user interaction; PR:N since no elevated privileges are needed; C:H for heap disclosure; A:H for potential crash via out-of-bounds read.

3.1 AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:H
4.0 AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:N/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (VulnCheck).

CVSS VectorVendor: VulnCheck

CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Attack Vector
Local
Attack Complexity
Low
Privileges Required
None
User Interaction
P
Scope
X

Lifecycle Timeline

2
Source Code Evidence Fetched
Aug 21, 2026 - 21:30 vuln.today
Analysis Generated
Aug 21, 2026 - 21:30 vuln.today

DescriptionCVE.org

GNU Emacs before 31.0.91 contains an integer overflow in the PBM/PPM/PGM image loader that allows an attacker to leak heap memory contents by supplying a crafted image with large dimensions and an elevated max color index. The image loader multiplies image dimensions and channel count using signed integer arithmetic; for sufficiently large values, the result wraps to a negative number, bypassing the bounds check and causing the pixel reader to access heap memory past the end of the allocated buffer. The over-read contents are interpreted as pixel color values and rendered on screen.

AnalysisAI

Integer overflow in GNU Emacs PBM/PPM/PGM image loader (all versions before 31.0.91) enables heap memory disclosure when a user opens a crafted image file. Signed integer multiplication of image height, width, and channel count wraps to a negative value for sufficiently large inputs, bypassing the allocated-buffer bounds check and allowing the pixel reader to over-read heap contents, which are then rendered on-screen as color values. …

Unlock full vulnerability intelligence

  • Risk assessment & exploitation conditions
  • Attack chain visualization
  • Remediation with exact patch versions
  • Threat intelligence from 22 sources
  • Personal watchlist & email alerts
Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access
technique details hidden
Delivery
technique details hidden
Exploit
technique details hidden
Execution
technique details hidden
Persist
technique details hidden
Impact
technique details hidden
Sign in to reveal

Vulnerability AssessmentAI

Exploitation Exploitation requires the target to open a specially crafted PBM, PPM, or PGM image file in a vulnerable GNU Emacs instance (any version before 31.0.91). … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment The CVSS 4.0 vector (AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VA:H) places this at a score of 6.9, reflecting local attack vector with user interaction required but no privilege prerequisite. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario Full exploit scenario with step-by-step reproduction available after sign-in.
Remediation Upgrade GNU Emacs to version 31.0.91 or later; the patched release is available at https://github.com/emacs-mirror/emacs/releases/tag/emacs-31.0.91. … Detailed patch versions, workarounds, and compensating controls in full report.
Sign in to read full assessment

Threat intelligence, references, and detailed analysis are available after sign-in.

More in Emacs

View all
CVE-2012-0035 CRITICAL
9.3 Jan 19

Untrusted search path vulnerability in EDE in CEDET before 1.0.1, as used in GNU Emacs before 23.4 and other products, a
CVE-2024-39331 CRITICAL
9.8 Jun 23

In Emacs before 29.4, org-link-expand-abbrev in lisp/ol.el expands a %(...) link abbrev even when it specifies an unsafe
CVE-2017-14482 HIGH
8.8 Sep 14

GNU Emacs before 25.3 allows remote attackers to execute arbitrary code via email with crafted "Content-Type: text/enric
CVE-2024-53920 HIGH
7.8 Nov 27

In elisp-mode.el in GNU Emacs before 30.1, a user who chooses to invoke elisp-completion-at-point (for code completion)

CVE-2024-30202 HIGH
7.8 Mar 25

In Emacs before 29.3, arbitrary Lisp code is evaluated as part of turning on Org mode. Rated high severity (CVSS 7.8), t
CVE-2023-2491 HIGH
7.8 May 17

A flaw was found in the Emacs text editor. Rated high severity (CVSS 7.8), this vulnerability is low attack complexity.

CVE-2023-27986 HIGH
7.8 Mar 09

emacsclient-mail.desktop in Emacs 28.1 through 28.2 is vulnerable to Emacs Lisp code injections through a crafted mailto
CVE-2023-27985 HIGH
7.8 Mar 09

emacsclient-mail.desktop in Emacs 28.1 through 28.2 is vulnerable to shell command injections through a crafted mailto:

CVE-2022-45939 HIGH
7.8 Nov 28

GNU Emacs through 28.2 allows attackers to execute commands via shell metacharacters in the name of a source-code file,

CVE-2014-9483 HIGH
7.5 Aug 28

Emacs 24.4 allows remote attackers to bypass security restrictions. Rated high severity (CVSS 7.5), this vulnerability i
CVE-2012-3479 MEDIUM
6.8 Aug 25

lisp/files.el in Emacs 23.2, 23.3, 23.4, and 24.1 automatically executes eval forms in local-variable sections when the

CVE-2024-30205 HIGH
7.1 Mar 25

In Emacs before 29.3, Org mode considers contents of remote files to be trusted. Rated high severity (CVSS 7.1), this vu

Same weakness CWE-190 – Integer Overflow or Wraparound

View all
CVE-2013-2729 CRITICAL POC
9.8
CVE-2015-8651 HIGH
8.8
CVE-2012-5054 HIGH POC
8.8
CVE-2014-0569 CRITICAL POC
9.3
CVE-2023-21716 CRITICAL POC
9.8
CVE-2017-3599 HIGH POC
7.5
CVE-2017-7529 HIGH
7.5
CVE-2016-1010 HIGH
8.8

Same technique Integer Overflow

View all
CVE-2014-0497 CRITICAL POC
9.8
CVE-2013-2729 CRITICAL POC
9.8
CVE-2015-8651 HIGH
8.8
CVE-2012-5054 HIGH POC
8.8
CVE-2014-0569 CRITICAL POC
9.3
CVE-2023-21716 CRITICAL POC
9.8
CVE-2017-3599 HIGH POC
7.5
CVE-2017-7529 HIGH
7.5

Share

EUVD-2026-64138 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy