Skip to content
OpenAdvisories
High ALAS2-2026-3944 2 CVEs

Important: emacs security update (Amazon Linux 2)

Published Sep 28, 2026 · Updated Sep 28, 2026

Summary

Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2026-79992: A flaw was found in Emacs TRAMP. A local attacker could exploit this vulnerability by processing maliciously crafted filenames. This occurs because TRAMP concatenates login arguments without proper sanitization, which are then passed to a local shell. Successful exploitation could lead to arbitrary code execution. CVE-2026-77219: GNU Emacs before 31.0.91 contains an integer overflow in the PBM/PPM/PGM image loader that allows an attacker to leak heap memory contents by supplying a crafted image with large dimensions and an elevated max color index. The image loader multiplies image dimensions and channel count using signed integer arithmetic; for sufficiently large values, the result wraps to a negative number, bypassing the bounds check and causing the pixel reader to access heap memory past the end of the allocated buffer. The over-read contents are interpreted as pixel color values and rendered on screen.

Fixed packages 8

ReleasePackageFixed in
Amazon Linux · 2 emacs 1:27.2-4.amzn2.0.8
Amazon Linux · 2 emacs-common 1:27.2-4.amzn2.0.8
Amazon Linux · 2 emacs-debuginfo 1:27.2-4.amzn2.0.8
Amazon Linux · 2 emacs-devel 1:27.2-4.amzn2.0.8
Amazon Linux · 2 emacs-filesystem 1:27.2-4.amzn2.0.8
Amazon Linux · 2 emacs-lucid 1:27.2-4.amzn2.0.8
Amazon Linux · 2 emacs-nox 1:27.2-4.amzn2.0.8
Amazon Linux · 2 emacs-terminal 1:27.2-4.amzn2.0.8

Vulnerabilities 2

References

  • web
    https://alas.aws.amazon.com/cve/html/CVE-2026-77219.html
  • web
    https://alas.aws.amazon.com/cve/html/CVE-2026-79992.html