CVE-2026-77219

EUVD-2026-64138

21.08.2026, 21:17

GNU Emacs before 31.0.91 contains an integer overflow in the PBM/PPM/PGM image loader that allows an attacker to leak heap memory contents by supplying a crafted image with large dimensions and an elevated max color index. The image loader multiplies image dimensions and channel count using signed integer arithmetic; for sufficiently large values, the result wraps to a negative number, bypassing the bounds check and causing the pixel reader to access heap memory past the end of the allocated buffer. The over-read contents are interpreted as pixel color values and rendered on screen.

Provider	Type	Base Score	Atk. Vector	Atk. Complexity	Priv. Required	Vector
VulnCheck	CNA	7.1 HIGH	LOCAL	LOW	NONE	CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:H

Base Score

CVSS 3.x

EPSS Score

Percentile: 2.12%

Early Detection

Affected products identified ahead of NVD analysis through intelligence sources.

Vendor	Product	Version	Source
gnu	emacs	𝑥 < 31.0.91	CNA

Debian Releases

Debian Product

Codename

emacs

bookworm	vulnerable
bookworm (security)	vulnerable
forky	vulnerable
sid	vulnerable
trixie	vulnerable
trixie (security)	vulnerable

Ubuntu Releases

Ubuntu Product

Codename

emacs

focal	needs-triage
jammy	needs-triage
noble	needs-triage
resolute	needs-triage

xemacs21

bionic	needs-triage
focal	needs-triage
jammy	needs-triage
noble	needs-triage
resolute	needs-triage
xenial	needs-triage

xemacs21-packages

bionic	needs-triage
focal	needs-triage
jammy	needs-triage
noble	needs-triage
resolute	needs-triage
xenial	needs-triage

emacs24

jammy	dne
noble	dne
resolute	dne
xenial	needs-triage

emacs25

bionic	needs-triage
jammy	dne
noble	dne
resolute	dne

openSUSE / SLES Releases

openSUSE Product

Release

emacs

suse enterprise desktop 15 SP7	27.2-150400.3.31.2 fixed
suse enterprise sap 12 SP5	24.3-25.26.1 fixed
suse enterprise sap 15 SP4	27.2-150400.3.31.2 fixed
suse enterprise sap 15 SP5	27.2-150400.3.31.2 fixed
suse enterprise sap 15 SP6	27.2-150400.3.31.2 fixed
suse enterprise sap 15 SP7	27.2-150400.3.31.2 fixed
suse enterprise server 12 SP3	24.3-25.26.1 fixed
suse enterprise server 12 SP5	24.3-25.26.1 fixed
suse enterprise server 15 SP4	27.2-150400.3.31.2 fixed
suse enterprise server 15 SP5	27.2-150400.3.31.2 fixed
suse enterprise server 15 SP6	27.2-150400.3.31.2 fixed
suse enterprise server 15 SP7	27.2-150400.3.31.2 fixed

emacs-el

suse enterprise desktop 15 SP7	27.2-150400.3.31.2 fixed
suse enterprise sap 12 SP5	24.3-25.26.1 fixed
suse enterprise sap 15 SP4	27.2-150400.3.31.2 fixed
suse enterprise sap 15 SP5	27.2-150400.3.31.2 fixed
suse enterprise sap 15 SP6	27.2-150400.3.31.2 fixed
suse enterprise sap 15 SP7	27.2-150400.3.31.2 fixed
suse enterprise server 12 SP3	24.3-25.26.1 fixed
suse enterprise server 12 SP5	24.3-25.26.1 fixed
suse enterprise server 15 SP4	27.2-150400.3.31.2 fixed
suse enterprise server 15 SP5	27.2-150400.3.31.2 fixed
suse enterprise server 15 SP6	27.2-150400.3.31.2 fixed
suse enterprise server 15 SP7	27.2-150400.3.31.2 fixed

emacs-info

suse enterprise desktop 15 SP7	27.2-150400.3.31.2 fixed
suse enterprise sap 12 SP5	24.3-25.26.1 fixed
suse enterprise sap 15 SP4	27.2-150400.3.31.2 fixed
suse enterprise sap 15 SP5	27.2-150400.3.31.2 fixed
suse enterprise sap 15 SP6	27.2-150400.3.31.2 fixed
suse enterprise sap 15 SP7	27.2-150400.3.31.2 fixed
suse enterprise server 12 SP3	24.3-25.26.1 fixed
suse enterprise server 12 SP5	24.3-25.26.1 fixed
suse enterprise server 15 SP4	27.2-150400.3.31.2 fixed
suse enterprise server 15 SP5	27.2-150400.3.31.2 fixed
suse enterprise server 15 SP6	27.2-150400.3.31.2 fixed
suse enterprise server 15 SP7	27.2-150400.3.31.2 fixed

emacs-nox

suse enterprise desktop 15 SP7	27.2-150400.3.31.2 fixed
suse enterprise sap 12 SP5	24.3-25.26.1 fixed
suse enterprise sap 15 SP4	27.2-150400.3.31.2 fixed
suse enterprise sap 15 SP5	27.2-150400.3.31.2 fixed
suse enterprise sap 15 SP6	27.2-150400.3.31.2 fixed
suse enterprise sap 15 SP7	27.2-150400.3.31.2 fixed
suse enterprise server 12 SP3	24.3-25.26.1 fixed
suse enterprise server 12 SP5	24.3-25.26.1 fixed
suse enterprise server 15 SP4	27.2-150400.3.31.2 fixed
suse enterprise server 15 SP5	27.2-150400.3.31.2 fixed
suse enterprise server 15 SP6	27.2-150400.3.31.2 fixed
suse enterprise server 15 SP7	27.2-150400.3.31.2 fixed

emacs-x11

suse enterprise sap 12 SP5	24.3-25.26.1 fixed
suse enterprise sap 15 SP4	27.2-150400.3.31.2 fixed
suse enterprise sap 15 SP5	27.2-150400.3.31.2 fixed
suse enterprise sap 15 SP6	27.2-150400.3.31.2 fixed
suse enterprise server 12 SP3	24.3-25.26.1 fixed
suse enterprise server 12 SP5	24.3-25.26.1 fixed
suse enterprise server 15 SP4	27.2-150400.3.31.2 fixed
suse enterprise server 15 SP5	27.2-150400.3.31.2 fixed
suse enterprise server 15 SP6	27.2-150400.3.31.2 fixed

etags

suse enterprise desktop 15 SP7	27.2-150400.3.31.2 fixed
suse enterprise sap 12 SP5	24.3-25.26.1 fixed
suse enterprise sap 15 SP4	27.2-150400.3.31.2 fixed
suse enterprise sap 15 SP5	27.2-150400.3.31.2 fixed
suse enterprise sap 15 SP6	27.2-150400.3.31.2 fixed
suse enterprise sap 15 SP7	27.2-150400.3.31.2 fixed
suse enterprise server 12 SP3	24.3-25.26.1 fixed
suse enterprise server 12 SP5	24.3-25.26.1 fixed
suse enterprise server 15 SP4	27.2-150400.3.31.2 fixed
suse enterprise server 15 SP5	27.2-150400.3.31.2 fixed
suse enterprise server 15 SP6	27.2-150400.3.31.2 fixed
suse enterprise server 15 SP7	27.2-150400.3.31.2 fixed

Amazon Linux Releases

Amazon Package

Release

emacs

Amazon Linux 2	1:27.2-4.amzn2.0.8 fixed
Amazon Linux 2023	1:28.2-3.amzn2023.0.11 fixed

emacs-common

Amazon Linux 2	1:27.2-4.amzn2.0.8 fixed
Amazon Linux 2023	1:28.2-3.amzn2023.0.11 fixed

emacs-common-debuginfo

Amazon Linux 2023

1:28.2-3.amzn2023.0.11

fixed

emacs-debuginfo

Amazon Linux 2	1:27.2-4.amzn2.0.8 fixed
Amazon Linux 2023	1:28.2-3.amzn2023.0.11 fixed

emacs-debugsource

Amazon Linux 2023

1:28.2-3.amzn2023.0.11

fixed

emacs-devel

Amazon Linux 2	1:27.2-4.amzn2.0.8 fixed
Amazon Linux 2023	1:28.2-3.amzn2023.0.11 fixed

emacs-filesystem

Amazon Linux 2	1:27.2-4.amzn2.0.8 fixed
Amazon Linux 2023	1:28.2-3.amzn2023.0.11 fixed

emacs-lucid

Amazon Linux 2	1:27.2-4.amzn2.0.8 fixed
Amazon Linux 2023	1:28.2-3.amzn2023.0.11 fixed

emacs-lucid-debuginfo

Amazon Linux 2023

1:28.2-3.amzn2023.0.11

fixed

emacs-nox

Amazon Linux 2	1:27.2-4.amzn2.0.8 fixed
Amazon Linux 2023	1:28.2-3.amzn2023.0.11 fixed

emacs-nox-debuginfo

Amazon Linux 2023

1:28.2-3.amzn2023.0.11

fixed

emacs-terminal

Amazon Linux 2	1:27.2-4.amzn2.0.8 fixed
Amazon Linux 2023	1:28.2-3.amzn2023.0.11 fixed

Azure Linux Releases

Azure Package

Release

emacs

Azure Linux 3.0

0:29.4-6.azl3

fixed

Common Weakness Enumeration

CWE-125 - Out-of-bounds Read
The software reads data past the end, or before the beginning, of the intended buffer.

References

https://debbugs.gnu.org/cgi/bugreport.cgi?bug=81344

https://github.com/emacs-mirror/emacs/commit/b07e634e4cf45162ae0178e32092b040587f2c6c

https://github.com/emacs-mirror/emacs/releases/tag/emacs-31.0.91

https://www.vulncheck.com/advisories/gnu-emacs-heap-over-read-via-pbm-ppm-pgm-image-loader