GNU Emacs before 31.0.91 contains an integer overflow in the PBM/PPM/PGM image loader that allows an attacker to leak heap memory contents by supplying a crafted image with large dimensions and an elevated max color index. The image loader multiplies image dimensions and channel count using signed integer arithmetic; for sufficiently large values, the result wraps to a negative number, bypassing the bounds check and causing the pixel reader to access heap memory past the end of the allocated buffer. The over-read contents are interpreted as pixel color values and rendered on screen.
CVSS Details
- CVSS 4.0 Base Score: 6.9 (MEDIUM)
- CVSS 4.0 Vector: (CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X)
- CVSS 3.1 Base Score: 7.1
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade emacs-lucidUpgrade emacsUpgrade emacs-noxUpgrade emacs-commonUpgrade emacs-filesystemUpgrade emacs-terminal | Oct 12, 2026 | Oct 12, 2026 |
| Amazon Linux Ami 2 | — | Upgrade emacs-noxUpgrade emacs-terminalUpgrade emacs-filesystemUpgrade emacs-lucidUpgrade emacs-commonUpgrade emacs-debuginfoUpgrade emacsUpgrade emacs-devel | Oct 19, 2026 | Oct 19, 2026 |
| Amazon_linux_2023 | — | Upgrade emacs-lucidUpgrade emacs-commonUpgrade emacs-develUpgrade emacs-lucid-debuginfoUpgrade emacs-nox-debuginfoUpgrade emacs-debugsourceUpgrade emacs-terminalUpgrade emacs-common-debuginfoUpgrade emacs-debuginfoUpgrade emacsUpgrade emacs-filesystemUpgrade emacs-nox | Sep 30, 2026 | Aug 21, 2026 |
| Oracle_linux | — | Upgrade emacs-terminalUpgrade emacs-commonUpgrade emacs-noxUpgrade emacs-lucidUpgrade emacsUpgrade emacs-nwUpgrade emacs-filesystem | Oct 22, 2026 | Aug 21, 2026 |
| Redhat_linux | — | Upgrade emacs-lucidUpgrade emacs-noxUpgrade emacs-debugsourceUpgrade emacs-nox-debuginfoUpgrade emacs-nw-debuginfoUpgrade emacs-nwUpgrade emacs-commonUpgrade emacs-lucid-debuginfoUpgrade emacs-common-debuginfoUpgrade emacsUpgrade emacs-gtk+x11-debuginfoUpgrade emacs-terminalUpgrade emacs-debuginfoUpgrade emacs-filesystemNo solution exists | Aug 26, 2026 | Aug 21, 2026 |
| Rocky_linux | — | Upgrade emacs-commonUpgrade emacs-nw-debuginfoUpgrade emacs-debugsourceUpgrade emacs-lucidUpgrade emacs-debuginfoUpgrade emacs-noxUpgrade emacs-nox-debuginfoUpgrade emacs-nwUpgrade emacs-lucid-debuginfoUpgrade emacs-common-debuginfoUpgrade emacs | Oct 15, 2026 | Oct 13, 2026 |
Prioritize with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub