GNU Emacs EUVD-2026-85187

Requires the victim to open or edit an untrusted file in Emacs (version prior to 31.2) with Flymake mode active AND using a language backend OTHER than Emacs Lisp; the vulnerable backend executes code embedded in the edited file during syntax checking. Limiting factors: exploitation is local (the malicious file must be delivered to and opened by the victim), requires user interaction (UI:R), depends on Flymake being enabled for that file's language, and yields only the privileges of the user running Emacs - no privilege escalation. The fix adds a trusted-content-p / flymake-always-safe gate so untrusted content no longer auto-runs backends.

This is a genuine code-execution flaw (CWE-94) in Emacs prior to 31.2, tracked and reported by Red Hat with vendor CVSS 7.8 (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H). The vector correctly reflects the real risk profile: exploitation is LOCAL (AV:L) because the malicious payload must reach the victim as a file they open in Emacs, and requires user interaction (UI:R) - merely viewing or editing an untrusted file with Flymake using a non-Lisp language backend triggers arbitrary code execution as the invoking user. PR:N is accurate: no authentication or privileges are needed to craft the file; the constraint is delivery and the victim's action, not credentials. No EPSS score, no CISA KEV listing, and no packaged exploit are present in the input, so this is NOT confirmed as actively exploited - status is 'no public exploit identified at time of analysis.' However, the two upstream fix commits and the oss-security disclosure ARE public, meaning the vulnerable code path and the trust-check that was missing are fully documented, which lowers the barrier to writing a PoC. Net: a real, high-technical-impact priority for environments where developers open untrusted files in Emacs, but not an internet-facing mass-exploitation issue - the local vector and required user interaction cap real-world urgency below what the 7.8 might suggest for a network flaw.

An attacker crafts a source file (e.g., a project file in a language whose Flymake backend shells out or evaluates content) and delivers it via a repository, email attachment, or shared directory. When the victim opens or edits the file in Emacs with Flymake syntax-checking active, the backend executes attacker-controlled code with the victim's privileges. No standalone weaponized exploit is published, but the upstream fix commits publicly reveal the exact missing trust check.