GNU Emacs EUVD-2026-97124

Exploitation requires that the victim use Emacs TRAMP to process an attacker-controlled filename: the malicious path's username component must contain shell metacharacters that bypass the incomplete tramp-user-regexp disallow list. Concretely, the attacker needs a way to get a crafted filename in front of the victim (a repository, directory listing, shared mount, or archive), and the victim must open, complete, or otherwise cause Emacs/TRAMP to evaluate that path. Limiting factors: the flaw is local (AV:L), affects only installations using TRAMP remote-file functionality, and realistically depends on user interaction with the malicious path; code runs only with the privileges of the Emacs user. It does not affect default non-TRAMP editing of trusted local files.

This is a genuine local/user-triggered code-execution flaw rather than a remotely-wormable crisis. The input CVSS of 7.8 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) reflects full confidentiality, integrity and availability loss via OS command injection, consistent with code execution in the context of the Emacs user. No EPSS score, no CISA KEV listing, and no public POC were provided, so exploitation signals are weak: this is 'no public exploit identified at time of analysis.' A notable tension exists in the CVSS vector itself: it specifies UI:N (no user interaction), yet the vulnerability is triggered by TRAMP processing a crafted filename, which in practice requires a victim to open or otherwise cause Emacs to evaluate that path - behavior that normally warrants UI:R. Verify the interaction requirement, as it materially changes real-world risk. A second important signal is that this is explicitly an incomplete fix for CVE-2026-79992 (tramp-user-regexp still has gaps), meaning the attack surface is already understood by researchers and the regex-bypass pattern is public conceptually even if weaponized code is not. Net: a real priority for developer/analyst workstations that use TRAMP, but not an internet-facing mass-exploitation threat - prioritize patching to Emacs 31.2 / TRAMP post-2.8.2 on multi-user or untrusted-content-handling hosts.

An attacker plants a file or directory whose name contains shell metacharacters crafted to slip past the incomplete tramp-user-regexp validation (for example inside a git repository, shared network folder, or tarball). When a victim opens or lists that path in Emacs with TRAMP engaged, the malformed username portion of the remote filename is passed to a shell, executing arbitrary OS commands as the victim. No public exploit code was identified, but because this is an incomplete fix for CVE-2026-79992 the bypass technique is already publicly documented.