Description
A command injection flaw was found in the text editor Emacs. It could allow a remote, unauthenticated attacker to execute arbitrary shell commands on a vulnerable system. Exploitation is possible by tricking users into visiting a specially crafted website or an HTTP URL with a redirect.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| — | emacs | < 29.4.0 | 29.4.0 |
| Red Hat | Red Hat Enterprise Linux 7 Extended Lifecycle Support | — | — |
| Red Hat | Red Hat Enterprise Linux 8 | — | — |
| Red Hat | Red Hat Enterprise Linux 8.2 Advanced Update Support | — | — |
| Red Hat | Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support | — | — |
| Red Hat | Red Hat Enterprise Linux 8.4 Telecommunications Update Service | — | — |
| Red Hat | Red Hat Enterprise Linux 8.4 Update Services for SAP Solutions | — | — |
| Red Hat | Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support | — | — |
| Red Hat | Red Hat Enterprise Linux 8.6 Telecommunications Update Service | — | — |
| Red Hat | Red Hat Enterprise Linux 8.6 Update Services for SAP Solutions | — | — |
| Red Hat | Red Hat Enterprise Linux 8.8 Extended Update Support | — | — |
| Red Hat | Red Hat Enterprise Linux 9 | — | — |
| Red Hat | Red Hat Enterprise Linux 9.0 Update Services for SAP Solutions | — | — |
| Red Hat | Red Hat Enterprise Linux 9.2 Extended Update Support | — | — |
| Red Hat | Red Hat Enterprise Linux 9.4 Extended Update Support | — | — |
| Red Hat | Builds for Red Hat OpenShift 1.3.2 | — | — |
| Red Hat | Red Hat Enterprise Linux 10 | — | — |
| Red Hat | Red Hat Enterprise Linux 6 | — | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | emacs | 1:30.1+1-1 | — |
| Debian 13 | emacs | 1:30.1+1-1 | — |
| Debian 12 | emacs | 1:28.2+1-15+deb12u4 | DSA-5871-1 |
| Debian 11 | emacs | 1:27.1+1-3.1+deb11u6 | DLA-4069-1 |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 26.10 | xemacs21 +1 | No fix yet | — |
| Ubuntu 26.04 LTS | xemacs21 +1 | No fix yet | — |
| Ubuntu 25.10 | xemacs21 +1 | No fix yet | — |
| Ubuntu 24.04 LTS | xemacs21 +1 | No fix yet | — |
| Ubuntu 22.04 LTS | xemacs21 +1 | No fix yet | — |
Show 8 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 20.04 LTS | xemacs21 +1 | No fix yet | — |
| Ubuntu 18.04 LTS | xemacs21 +1 | No fix yet | — |
| Ubuntu 16.04 LTS | xemacs21 +1 | No fix yet | — |
| Ubuntu Pro 24.04 LTS | emacs | 1:29.3+1-1ubuntu2+esm3 | USN-8011-1 |
| Ubuntu Pro 22.04 LTS | emacs | 1:27.1+1-3ubuntu5.2+esm1 | USN-8011-1 |
| Ubuntu Pro 20.04 LTS | emacs | 1:26.3+1-1ubuntu2+esm2 | USN-8011-1 |
| Ubuntu Pro 18.04 LTS | emacs25 | No fix yet | — |
| Ubuntu Pro 16.04 LTS | emacs24 | No fix yet | — |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 9 | emacs +4 | 1:27.2-11.el9_5.1 | RHSA-2025:1915 |
| RHEL 8 | emacs +5 | 1:26.1-13.el8_10 | RHSA-2025:1917 |
Show 12 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 9.4 EUS | emacs +4 | 1:27.2-10.el9_4.1 | RHSA-2025:2195 |
| RHEL 9.2 EUS | emacs +4 | 1:27.2-8.el9_2.2 | RHSA-2025:1964 |
| RHEL 9.0 E4S | emacs +4 | 1:27.2-6.el9_0.2 | RHSA-2025:2022 |
| RHEL 8.8 EUS | emacs +5 | 1:26.1-10.el8_8.7 | RHSA-2025:1962 |
| RHEL 8.6 TUS | emacs +5 | 1:26.1-7.el8_6.6 | RHSA-2025:1961 |
| RHEL 8.6 E4S | emacs +5 | 1:26.1-7.el8_6.6 | RHSA-2025:1961 |
| RHEL 8.6 AUS | emacs +5 | 1:26.1-7.el8_6.6 | RHSA-2025:1961 |
| RHEL 8.4 TUS | emacs +5 | 1:26.1-5.el8_4.3 | RHSA-2025:1963 |
| RHEL 8.4 E4S | emacs +5 | 1:26.1-5.el8_4.3 | RHSA-2025:1963 |
| RHEL 8.4 AUS | emacs +5 | 1:26.1-5.el8_4.3 | RHSA-2025:1963 |
| RHEL 8.2 AUS | emacs +5 | 1:26.1-5.el8_2.3 | RHSA-2025:2157 |
| RHEL 7 ELS | emacs +5 | 1:24.3-23.el7_9.2 | RHSA-2025:2130 |
AlmaLinux
Errata ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| AlmaLinux 9 | emacs +4 | 1:27.2-11.el9_5.1 | ALSA-2025:1915 |
| AlmaLinux 8 | emacs +5 | 1:26.1-13.el8_10 | ALSA-2025:1917 |
Rocky Linux
Errata ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Rocky Linux 9 | emacs | 1:27.2-11.el9_5.1 | RLSA-2025:1915 |
| Rocky Linux 8 | emacs | 1:26.1-13.el8_10 | RLSA-2025:1917 |
SUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLES 15 SP6 | emacs | 27.2-150400.3.23.2 | SUSE-SU-2025:0599-1 |
| SLES 15 SP5 | emacs | 27.2-150400.3.23.2 | SUSE-SU-2025:0599-1 |
| SLES 15 SP4 | emacs | 27.2-150400.3.23.2 | SUSE-SU-2025:0599-1 |
| SLES 15 SP3 | emacs | 25.3-150000.3.25.3 | SUSE-SU-2025:0589-1 |
| SLES 12 SP5 | emacs | 24.3-25.23.1 | SUSE-SU-2025:0574-1 |
Show 9 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLES for SAP 15 SP5 | emacs | 27.2-150400.3.23.2 | SUSE-SU-2025:0599-1 |
| SLES for SAP 15 SP4 | emacs | 27.2-150400.3.23.2 | SUSE-SU-2025:0599-1 |
| SLES for SAP 15 SP3 | emacs | 25.3-150000.3.25.3 | SUSE-SU-2025:0589-1 |
| SLE HPC 15 SP5 | emacs | 27.2-150400.3.23.2 | SUSE-SU-2025:0599-1 |
| SLE HPC 15 SP4 | emacs | 27.2-150400.3.23.2 | SUSE-SU-2025:0599-1 |
| SLE HPC 15 SP3 | emacs | 25.3-150000.3.25.3 | SUSE-SU-2025:0589-1 |
| SUSE Manager Server 4.3 | emacs | 27.2-150400.3.23.2 | SUSE-SU-2025:0599-1 |
| SUSE Manager Proxy 4.3 | emacs | 27.2-150400.3.23.2 | SUSE-SU-2025:0599-1 |
| SUSE Enterprise Storage 7.1 | emacs | 25.3-150000.3.25.3 | SUSE-SU-2025:0589-1 |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | emacs | 29.4-14.1 | openSUSE-SU-2025:14767-1 |
| openSUSE Leap 15.6 | emacs | 27.2-150400.3.23.2 | SUSE-SU-2025:0599-1 |
Amazon Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Amazon Linux 2023 | emacs +6 | 1:28.2-3.amzn2023.0.10 | ALAS2023-2025-867 |
| Amazon Linux 2 | emacs +6 | 1:27.2-4.amzn2.0.7 | ALAS2-2025-2770 |
Azure Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Azure Linux 3 | emacs | 29.4-2 | — |
| Azure Linux 2 (CBL-Mariner) | emacs | 29.4-2 | — |
Oracle Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Oracle Linux 9 | emacs +4 | 1:27.2-11.el9_5.1 | ELSA-2025-1915 |
| Oracle Linux 8 | emacs +5 | 1:26.1-13.el8_10 | ELSA-2025-1917 |
| Oracle Linux 7 | emacs +5 | 1:24.3-23.0.1.el7_9.1 | ELSA-2025-2130 |
Advisories 27
- ALSA-2025:1915 Important: emacs security update AlmaLinux Security Advisories · Oct 29, 2026
- ALSA-2025:1917 Important: emacs security update AlmaLinux Security Advisories · Oct 29, 2026
- RHSA-2025:2195 Red Hat Security Advisory: emacs security update Red Hat Security Advisories (RHSA) · Sep 6, 2026
- RHSA-2025:2157 Red Hat Security Advisory: emacs security update Red Hat Security Advisories (RHSA) · Sep 6, 2026
- RHSA-2025:2130 Red Hat Security Advisory: emacs security update Red Hat Security Advisories (RHSA) · Sep 6, 2026
- RHSA-2025:2022 Red Hat Security Advisory: emacs security update Red Hat Security Advisories (RHSA) · Sep 6, 2026
- RHSA-2025:1963 Red Hat Security Advisory: emacs security update Red Hat Security Advisories (RHSA) · Sep 6, 2026
- RHSA-2025:1964 Red Hat Security Advisory: emacs security update Red Hat Security Advisories (RHSA) · Sep 6, 2026
- RHSA-2025:1961 Red Hat Security Advisory: emacs security update Red Hat Security Advisories (RHSA) · Sep 6, 2026
- RHSA-2025:1962 Red Hat Security Advisory: emacs security update Red Hat Security Advisories (RHSA) · Sep 6, 2026
- RHSA-2025:1917 Red Hat Security Advisory: emacs security update Red Hat Security Advisories (RHSA) · Sep 6, 2026
- RHSA-2025:1915 Red Hat Security Advisory: emacs security and bug fix update Red Hat Security Advisories (RHSA) · Sep 6, 2026
- USN-8011-1 emacs vulnerabilities Ubuntu Security Notices (USN) · Apr 27, 2026
- DSA-5871-1 emacs - security update Debian Security (DSA / DLA) · Mar 9, 2026
- DLA-4069-1 emacs - security update Debian Security (DSA / DLA) · Mar 9, 2026
- WID-SEC-2025-0353 GNU Emacs: Schwachstelle ermöglicht Codeausführung BSI CERT-Bund (WID) · Feb 4, 2026
- SUSE-SU-2025:0599-1 Security update for emacs SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2025:0574-1 Security update for emacs SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2025:0589-1 Security update for emacs SUSE / openSUSE Security Updates · Feb 4, 2026
- openSUSE-SU-2025:14767-1 emacs-29.4-14.1 on GA media SUSE / openSUSE Security Updates · Feb 4, 2026
- RLSA-2025:1915 Important: emacs security update Rocky Linux Security Advisories · May 7, 2025
- RLSA-2025:1917 Important: emacs security update Rocky Linux Security Advisories · May 7, 2025
- ELSA-2025-2130 Important: emacs security update (Oracle Linux 7) Oracle Linux Security Advisories (ELSA) · Mar 21, 2025
- ALAS2-2025-2770 Important: emacs security update (Amazon Linux 2) Amazon Linux Security Center (ALAS) · Mar 7, 2025
- ALAS2023-2025-867 Important: emacs security update (Amazon Linux 2023) Amazon Linux Security Center (ALAS) · Mar 5, 2025
- ELSA-2025-1915 Important: emacs security update (Oracle Linux 9) Oracle Linux Security Advisories (ELSA) · Feb 28, 2025
- ELSA-2025-1917 Important: emacs security update (Oracle Linux 8) Oracle Linux Security Advisories (ELSA) · Feb 27, 2025
References
- RHSA-2025:1915 vendor-advisory
- RHSA-2025:1917 vendor-advisory
- RHSA-2025:1961 vendor-advisory
- RHSA-2025:1962 vendor-advisory
- RHSA-2025:1963 vendor-advisory
- RHSA-2025:1964 vendor-advisory
- RHSA-2025:2022 vendor-advisory
- RHSA-2025:2130 vendor-advisory
- RHSA-2025:2157 vendor-advisory
- RHSA-2025:2195 vendor-advisory
- RHSA-2025:2754 vendor-advisory
- https://access.redhat.com/security/cve/CVE-2025-1244 vdb-entry
- RHBZ#2345150 issue-tracking
- https://git.savannah.gnu.org/cgit/emacs.git/commit/?id=820f0793f0b46448928905552726c1f1b999062f