Вернуться к предупреждениям о безопасности

Emacs Security Update — AlmaLinux 10 (ALSA-2026:90887)

ALSA-2026:90887 updates GNU Emacs on AlmaLinux 10, fixing CVE-2026-96269 — arbitrary code execution through the editor (rated CVSS 7.5, CWE-829 inclusion of untrusted functionality). Emacsen that open untrusted files or elisp packages are the exposure path. Update with dnf update emacs and restart any running Emacs sessions.

High 7.5 CVSS
AlmaLinux 10

Что это значит по лицензии SharedLicense

Arbitrary code execution in Emacs typically arrives through malicious files or packages: opening a crafted document or installing a trojan elisp package runs attacker code with the user's full privileges.

Type:

security

Severity:

important

Release date:

2026-10-28

Description:

GNU Emacs is a powerful, customizable, self-documenting text editor. It provides special code editing features, a scripting language (elisp), and the capability to read e-mail and news.

Security Fix(es):

* emacs: GNU Emacs: Arbitrary code execution upon opening a file (CVE-2026-96269)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

References:

Updated packages listed below:

Architecture Package Checksum
aarch64 emacs-common-29.4-14.el10_2.4.aarch64.rpm 2e4784984d19963692d2f0a025fbfbf33b9e0612c50d8daee21aba5a9cf1da9a
aarch64 emacs-29.4-14.el10_2.4.aarch64.rpm 6b82e0be028ced9284daa9b272b81db2cbca4d04230b9010b6ba43c411cfc5d0
aarch64 emacs-nw-29.4-14.el10_2.4.aarch64.rpm b5713288643dae5abfb1883dfcf7c8106d50a1b63ab7e46f1458f299bf9c5ae5
aarch64 emacs-lucid-29.4-14.el10_2.4.aarch64.rpm b9f24af75c6f1ebad5efc99575f72619b403280e6bc9b1b753bf22b0df144842
noarch emacs-filesystem-29.4-14.el10_2.4.noarch.rpm 3e6e3b924afb7f0c3b18897e78bcc8a9725964b302ee83cd963d479deafd4f3f
ppc64le emacs-nw-29.4-14.el10_2.4.ppc64le.rpm 21a54440e80f7070d1eb8be89f3166e5d5ff3788bc17c521010f8f1cd3239b64
ppc64le emacs-29.4-14.el10_2.4.ppc64le.rpm 9300731e5b9e1d6270aa0bc2bef2b9d2749fdcf1311cf0cf7f59f139cd0183a4
ppc64le emacs-lucid-29.4-14.el10_2.4.ppc64le.rpm 996899da4caae18adea58451d85ac3aec7c035255b026841badbedfb3fb42696
ppc64le emacs-common-29.4-14.el10_2.4.ppc64le.rpm bbb7fbb1df99903982d0cefc40567874b01ac5cdfaf53a44fa0edae68b598208
s390x emacs-29.4-14.el10_2.4.s390x.rpm 1a3a2a089d6b411c850619303343e4bc2666f0e3295cd499ef040892ebd30431
s390x emacs-nw-29.4-14.el10_2.4.s390x.rpm 1a8a3f57b0dc55532de35404d376aceb77934aa1789422efad73a468ef11c1f1
s390x emacs-common-29.4-14.el10_2.4.s390x.rpm 4a21a9367b7b97cfd0fce0948520d5ab972950d489d7d41774ff16b26bccb05b
s390x emacs-lucid-29.4-14.el10_2.4.s390x.rpm 87d69e7e1bf094dc1744354ec3335a6b7fa24b8e32857c3cb39e6bc71bc88767
x86_64 emacs-nw-29.4-14.el10_2.4.x86_64.rpm 17e2aec2e3e058d875175125643ae5c756dad08940b44960359366e188230480
x86_64 emacs-lucid-29.4-14.el10_2.4.x86_64.rpm 180a5194a240843439280c1208249d18024ad3406163228a5fa3d379edca4b7f
x86_64 emacs-common-29.4-14.el10_2.4.x86_64.rpm 8715615a6c30b9077c46d542b219f6bb707ac4c02a9b9617e6b38099308a47db
x86_64 emacs-29.4-14.el10_2.4.x86_64.rpm b388657e11fcfec5205b8d975c5312d6c98eeacfafd92065ceea4cd2934a60ec
x86_64_v2 emacs-lucid-29.4-14.el10_2.4.x86_64_v2.rpm 0c32282d83208686a9fdb37a0ae06a665b0f9e2648c88f64acd32e366e5bef59
x86_64_v2 emacs-common-29.4-14.el10_2.4.x86_64_v2.rpm 57b2b1a4879333b4761ed5e2bb6f74c56bb228eb169051892dd7648e1588693e
x86_64_v2 emacs-29.4-14.el10_2.4.x86_64_v2.rpm 97fee81ae22d379eb8c377fcfe6a71db7af636e4df94d6ec72dae2c77a0ccfcb
x86_64_v2 emacs-nw-29.4-14.el10_2.4.x86_64_v2.rpm f36a0e268f6be1e6cad4c00dbdb689175da52d6de426b1bd68021e1f08100775

Notes:

This page is generated automatically from Red Hat security data and has not been checked for errors. For clarification or corrections please contact the AlmaLinux Packaging Team.

Часто задаваемые вопросы

What is CVE-2026-96269?
It is an arbitrary code execution vulnerability in GNU Emacs, fixed in the AlmaLinux 10 emacs update ALSA-2026:90887 (rated Important, CVSS 7.5, CWE-829 — inclusion of untrusted functionality).
Who is affected?
AlmaLinux 10 systems with emacs installed where users open untrusted files or install third-party elisp packages. Headless servers with emacs available to shell users are also in scope.
How do I apply the fix?
Run dnf update emacs and restart any running Emacs instances — the patched binary loads on next start. Verify with emacs --version reporting the updated build.
Is CVE-2026-96269 exploited remotely?
The erratum describes code execution through the editor itself rather than a network service — the realistic path is a crafted file or package being opened by a user. No exploitation is reported in the erratum data.

Источники

Предупреждения о безопасности

Похожие предупреждения

Nodejs-Nodemon Security Update — AlmaLinux 10 (ALSA-2026:96236)

2026-11-10

Nodejs22 Security Update — AlmaLinux 10 (ALSA-2026:96094)

2026-11-10

Nodejs24 Security Update — AlmaLinux 10 (ALSA-2026:96088)

2026-11-10

Проверьте систему на уязвимости

Выберите продукт и операционную систему, чтобы увидеть точные команды исправления.

Проверьте свою систему