Emacs TRAMP EUVD-2026-65616

Exploitation requires the target system to have Emacs installed with TRAMP active (the default Emacs configuration on RHEL) and a user on the system who is running Emacs and processes files via the TRAMP subsystem. The attacker must hold a local user account (PR:L per CVSS vector) and must be able to place or influence a maliciously crafted filename in a filesystem location that the victim user accesses through TRAMP - for example, a shared directory, a world-writable path, or a location the attacker controls via symlink. No network access is required; the attack is strictly local (AV:L). No user interaction beyond the victim's normal file access behavior via TRAMP is necessary (UI:N). Limiting factors: the attacker cannot exploit this remotely; must share filesystem access with the victim; and the victim must be actively using Emacs with TRAMP enabled. Environments where Emacs is not installed or TRAMP is explicitly disabled are not affected.

The CVSS 7.8 HIGH rating with vector AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H accurately reflects the local, low-complexity nature of this flaw. The local attack vector (AV:L) is the primary risk-limiting factor - no network-based exploitation path exists, and an attacker must already hold a local user account on the target system. Low attack complexity and no required user interaction indicate the exploit mechanism is straightforward once access is established. No EPSS probability data is included in the available record, and there is no CISA KEV listing, so widespread active exploitation is not confirmed; these signals together suggest this is not under active mass exploitation at time of analysis. The full C:H/I:H/A:H impact triad is consistent with arbitrary code execution in the victim process context, which may include access to sensitive files, SSH keys, or credentials managed by the victim user. Priority should be elevated for multi-user RHEL servers, shared developer workstations, and CI/CD systems where multiple principals share a host and Emacs is actively used with TRAMP-enabled remote access. The absence of a confirmed patched version in available data introduces remediation uncertainty.

A low-privileged local attacker on a shared RHEL server creates a filename containing shell metacharacters (e.g., a semicolon or backtick sequence encoding a reverse shell payload) in a directory accessible to a target user who actively uses Emacs with TRAMP. When the victim user's Emacs session processes or accesses that filename via TRAMP - for example, by navigating a directory listing - the crafted filename is concatenated unsanitized into a login argument passed to the local shell, executing the attacker's payload with the victim's privileges. No public proof-of-concept code is identified at time of analysis, though the low CVSS attack complexity rating indicates the exploitation path is not technically demanding.