IT-Sentinel

« BACK_TO_HOME

PUBLISHED

2026-09-23 11:17

MODIFIED

2026-09-23 11:17

CVSS_SCORE V3

7.8

EPSS (Prob. Exploit)

0.17%

Top 94.5%

DATA SOURCES:

NVD 🔗 2026-09-23 CWE MITRE 🔗 2026-10-01 FIRST EPSS 🔗 2026-10-21 OSV 🔗 2026-10-19 MSRC 🔗 2026-09-29

> DESCRIPTION

A code execution flaw was found in Emacs, affecting versions prior to 31.2. The Flymake mode using language backends other than Lisp would execute arbitrary code from the edited file while performing syntax checking. Viewing or editing untrusted files using Emacs could lead to arbitrary code execution with the privileges of the user running Emacs.

> AFFECTED_PRODUCTS

ℹ️ Aucun produit affecté n'a encore été publié par NVD pour cette CVE.

> CVSS V3 METRICS

CVSS_VECTOR

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

EXPLOITABILITY

1.8

IMPACT

5.9

> MÉTRIQUES CVSS DÉTAILLÉES

                CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
            

Métrique	Valeur	Interprétation
AV (Vecteur d'Attaque) Attack Vector	Local (L)	Exploit nécessite un accès local au système
AC (Complexité d'Attaque) Attack Complexity	Low (L)	Peu de conditions requises pour exploiter
PR (Privilèges Requis) Privileges Required	None (N)	Aucune authentification requise
UI (Interaction Utilisateur) User Interaction	Required (R)	Nécessite une action utilisateur (clic lien, ouverture fichier, etc.)
S (Périmètre) Scope	Unchanged (U)	Impact reste dans le périmètre du composant compromis
C (Impact Confidentialité) Confidentiality Impact	High (H)	Divulgation totale d'informations
I (Impact Intégrité) Integrity Impact	High (H)	Modification totale des données possible
A (Impact Disponibilité) Availability Impact	High (H)	Interruption totale du service possible

> RÉSUMÉ DES IMPACTS

Confidentialité

High

Divulgation totale d'informations

Intégrité

High

Modification totale des données possible

Disponibilité

High

Interruption totale du service possible

> WEAKNESSES

CWE-94

> CWE DETAILED DESCRIPTIONS

CWE-94: Improper Control of Generation of Code ('Code Injection') - The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.

> RED HAT SECURITY ADVISORIES

RHSA-2026:84591 IMPORTANT

Red Hat Security Advisory: emacs security update

An update for emacs is now available for Red Hat Enterprise Linux 10. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (C...

RHSA-2026:85245 IMPORTANT

Red Hat Security Advisory: emacs security update

An update for emacs is now available for Red Hat Enterprise Linux 9. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CV...