6.9
Moyenne
CVE-2026-77219 GNU Emacs before 31.0.91 contains an integer overflow in the PBM/PPM/PGM image loader that allows an attacker to leak…
Description
GNU Emacs before 31.0.91 contains an integer overflow in the PBM/PPM/PGM image loader that allows an attacker to leak heap memory contents by supplying a crafted image with large dimensions and an elevated max color index. The image loader multiplies image dimensions and channel count using signed integer arithmetic; for sufficiently large values, the result wraps to a negative number, bypassing the bounds check and causing the pixel reader to access heap memory past the end of the allocated buffer. The over-read contents are interpreted as pixel color values and rendered on screen.
Produits et versions touchés
| Produit | Versions touchées | Corrigé en |
|---|---|---|
| Emacs 31.0 | premières → < 31.0.91 | 31.0.91 |
Références
- Bug Report debbugs.gnu.org
- Release Tag github.com
- Patch Commit github.com
- www.vulncheck.com www.vulncheck.com
Chronologie
- Publiée
- Dernière modification
Autres CVE de Emacs
Les 9 CVE de Emacs →
CVE-2026-108976
GNU Emacs before 31.2 (and TRAMP through 2.8.2) allows OS command injection via a filename because tramp-user-regexp has…
7.8
Élevée
CVE-2026-96269
GNU Emacs 28.1 through 31.1 allows arbitrary code execution upon opening a file, because an untrusted value of…
7.5
Élevée
CVE-2026-71394
GNU Emacs for Android improperly validates the table header input in sfnt_read_table_directory() in src/sfnt.c
5.3
Moyenne
CVE-2026-71393
GNU Emacs for Android is vulnerable to an integer overflow in sfnt_read_name_table() in src/sfnt.c
5.3
Moyenne