Skip to content
Heist/ feed
UnratedFix available

emacs vulnerability

Type: advisorySource: OSV1 source record

It was discovered that Emacs improperly handled specially crafted SVG images, resulting in memory corruption. An attacker could possibly use this issue to cause Emacs to crash, resulting in a denial of service, or obtain sensitive information.

Announced Source revision 1
Original source ↗

USN-8835-1

Primary source · Revision 1

Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.

Security context

Source reference: osv:USN-8835-1

emacs

Source reference: /affected/0/package/name

Affected versions
1:29.1+1-5ubuntu1

Source reference: /affected/0/versions

1:29.2+1-1ubuntu1

Source reference: /affected/0/versions

1:29.2+1-2ubuntu4

Source reference: /affected/0/versions

1:29.3+1-1ubuntu2

Source reference: /affected/0/versions

1:29.3+1-1ubuntu2+esm1

Source reference: /affected/0/versions

1:29.3+1-1ubuntu2+esm3

Source reference: /affected/0/versions

Fixed versions
1:29.3+1-1ubuntu2+esm4

Source reference: /affected/0/ranges

Prerequisites
Not stated in this record

emacs

Source reference: /affected/1/package/name

Affected versions
1:30.1+1-9ubuntu1

Source reference: /affected/1/versions

1:30.2+1-1ubuntu2

Source reference: /affected/1/versions

1:30.2+1-2ubuntu1

Source reference: /affected/1/versions

Fixed versions
1:30.2+1-2ubuntu1+esm1

Source reference: /affected/1/ranges

Prerequisites
Not stated in this record

Structured affected-version data

Original package identities and version rules from this source.

[
  {
    "ranges": [
      {
        "type": "ECOSYSTEM",
        "events": [
          {
            "introduced": "0"
          },
          {
            "fixed": "1:29.3+1-1ubuntu2+esm4"
          }
        ]
      }
    ],
    "package": {
      "name": "emacs",
      "purl": "pkg:deb/ubuntu/emacs?arch=source&distro=esm-apps%2Fnoble",
      "ecosystem": "Ubuntu:Pro:24.04:LTS"
    },
    "versions": [
      "1:29.1+1-5ubuntu1",
      "1:29.2+1-1ubuntu1",
      "1:29.2+1-2ubuntu4",
      "1:29.3+1-1ubuntu2",
      "1:29.3+1-1ubuntu2+esm1",
      "1:29.3+1-1ubuntu2+esm3"
    ],
    "database_specific": {
      "source": "https://github.com/canonical/ubuntu-security-notices/blob/main/osv/usn/USN-8835-1.json",
      "cves_map": {
        "cves": [
          {
            "id": "CVE-2026-6861",
            "severity": [
              {
                "type": "CVSS_V3",
                "score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:H"
              },
              {
                "type": "CVSS_V3",
                "score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:H"
              },
              {
                "type": "Ubuntu",
                "score": "medium"
              }
            ]
          }
        ],
        "ecosystem": "Ubuntu:Pro:24.04:LTS"
      }
    },
    "ecosystem_specific": {
      "binaries": [
        {
          "binary_name": "emacs",
          "binary_version": "1:29.3+1-1ubuntu2+esm4"
        },
        {
          "binary_name": "emacs-bin-common",
          "binary_version": "1:29.3+1-1ubuntu2+esm4"
        },
        {
          "binary_name": "emacs-common",
          "binary_version": "1:29.3+1-1ubuntu2+esm4"
        },
        {
          "binary_name": "emacs-el",
          "binary_version": "1:29.3+1-1ubuntu2+esm4"
        },
        {
          "binary_name": "emacs-gtk",
          "binary_version": "1:29.3+1-1ubuntu2+esm4"
        },
        {
          "binary_name": "emacs-lucid",
          "binary_version": "1:29.3+1-1ubuntu2+esm4"
        },
        {
          "binary_name": "emacs-nox",
          "binary_version": "1:29.3+1-1ubuntu2+esm4"
        },
        {
          "binary_name": "emacs-pgtk",
          "binary_version": "1:29.3+1-1ubuntu2+esm4"
        }
      ],
      "availability": "Available with Ubuntu Pro: https://ubuntu.com/pro"
    }
  },
  {
    "ranges": [
      {
        "type": "ECOSYSTEM",
        "events": [
          {
            "introduced": "0"
          },
          {
            "fixed": "1:30.2+1-2ubuntu1+esm1"
          }
        ]
      }
    ],
    "package": {
      "name": "emacs",
      "purl": "pkg:deb/ubuntu/emacs?arch=source&distro=esm-apps%2Fresolute",
      "ecosystem": "Ubuntu:Pro:26.04:LTS"
    },
    "versions": [
      "1:30.1+1-9ubuntu1",
      "1:30.2+1-1ubuntu2",
      "1:30.2+1-2ubuntu1"
    ],
    "database_specific": {
      "source": "https://github.com/canonical/ubuntu-security-notices/blob/main/osv/usn/USN-8835-1.json",
      "cves_map": {
        "cves": [
          {
            "id": "CVE-2026-6861",
            "severity": [
              {
                "type": "CVSS_V3",
                "score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:H"
              },
              {
                "type": "CVSS_V3",
                "score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:H"
              },
              {
                "type": "Ubuntu",
                "score": "medium"
              }
            ]
          }
        ],
        "ecosystem": "Ubuntu:Pro:26.04:LTS"
      }
    },
    "ecosystem_specific": {
      "binaries": [
        {
          "binary_name": "emacs",
          "binary_version": "1:30.2+1-2ubuntu1+esm1"
        },
        {
          "binary_name": "emacs-bin-common",
          "binary_version": "1:30.2+1-2ubuntu1+esm1"
        },
        {
          "binary_name": "emacs-common",
          "binary_version": "1:30.2+1-2ubuntu1+esm1"
        },
        {
          "binary_name": "emacs-el",
          "binary_version": "1:30.2+1-2ubuntu1+esm1"
        },
        {
          "binary_name": "emacs-gtk",
          "binary_version": "1:30.2+1-2ubuntu1+esm1"
        },
        {
          "binary_name": "emacs-lucid",
          "binary_version": "1:30.2+1-2ubuntu1+esm1"
        },
        {
          "binary_name": "emacs-nox",
          "binary_version": "1:30.2+1-2ubuntu1+esm1"
        },
        {
          "binary_name": "emacs-pgtk",
          "binary_version": "1:30.2+1-2ubuntu1+esm1"
        }
      ],
      "availability": "Available with Ubuntu Pro: https://ubuntu.com/pro"
    }
  }
]

Publisher severity

No explicit severity was provided.

Event
#23742 · Revision 1
Added to Heist Feed
Publisher date
Read the original announcement