CVE-2026-96442

HighCVSS 7.8/10Last modified Oct 20, 2026

Description

A code execution flaw was found in Emacs, affecting versions prior to 31.2. The Flymake mode using language backends other than Lisp would execute arbitrary code from the edited file while performing syntax checking. Viewing or editing untrusted files using Emacs could lead to arbitrary code execution with the privileges of the user running Emacs.

Metrics

CVSS 3.1 7.8/10CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-94

Affected software

Source: the vendor's advisory (CNA). NVD analysis pending.

No affected versions have been published.

Timeline

Published: Sep 23, 2026
Last modified: Oct 20, 2026
NVD status: Awaiting Analysis

Related CVEs from 2026

CVE-2026-964436.5Insufficient validation of the JDBC driver URL in Apache Doris allows a privileged user to achieve remote code execution on the FE.CVE-2026-964456.8A flaw was found in the Conditional OTP authenticator of Keycloak, an identity and access management solution. The issue occurs when the sys CVE-2026-964464.2A flaw was found in the Pushed Authorization Request PAR implementation of Keycloak. The issue occurs when the silent authentication path pr CVE-2026-964486.6A flaw was found in the Fine-Grained Admin Permissions (FGAP v2) feature of Keycloak, an identity and access management solution. The issue CVE-2026-964495.3Missing Authorization vulnerability in WPExperts WP EasyPay wp-easy-pay allows Exploiting Incorrectly Configured Access Control Security Lev CVE-2026-96459.9Exposed methods allow authenticated users to create and execute arbitrary JavaScript code on the server. The scripts execute with full acces CVE-2026-964505.4Contributor Cross Site Scripting (XSS) in pixfort Core < 4.3.3 versions.CVE-2026-964518.8Authorization Bypass Through User-Controlled Key vulnerability in Ultimate Member Ultimate Member ultimate-member allows Privilege Escalatio CVE-2026-964548.2Pake turns a website into a desktop application built on Tauri. Every application it generates inherits two settings from the upstream templ CVE-2026-964558.8The Reachy Mini daemon exposes an HTTP API for managing the robot. Its app installation endpoint, POST /apps/install in src/reachy_mini/daem CVE-2026-964566.3The Reachy Mini Bluetooth service asks a connecting device for a PIN before it will accept commands. The check protects the session but not CVE-2026-96466.1A reflected cross-site scripting issue exists in URL handling.