GNU Emacs Arbitrary File Bug Enables Code Execution

A newly disclosed GNU Emacs vulnerability allows arbitrary code execution when a user opens a malicious file, affecting Emacs 28.1 and later. The issue was reported by researcher Eshel Yaron and discussed on both oss-sec and emacs-devel, where maintainers treated it as serious enough to factor into Emacs 31 release decisions. The flaw is tied to unsafe handling of read-symbol-shorthands around risky intern calls, with discussion highlighting the VC-related attack path as one of the easiest ways to trigger the bug.

Upstream published a workaround patch for the Emacs 31 branch and committed a broader rework on master, while Gentoo backported fixes that nullify read-symbol-shorthands around vulnerable code paths and shipped updated packages for 28.2, 29.4, and 30.2. Gentoo later issued GLSA-202608-18, and Tenable released a Nessus detection plugin for affected Gentoo installations. As an interim mitigation, users were advised to disable file-local variables if they cannot immediately apply patched versions.