Vulnerability-Lookup

OPENSUSE-SU-2026:21711-1

Vulnerability from csaf_opensuse - Published: 2026-08-31 11:49 - Updated: 2026-09-17 17:43

Summary

Security update for emacs

Severity

Important

Notes

Title of the patch: Security update for emacs

Description of the patch: This update for emacs fixes the following issues: Security issues fixed: - Arbitrary code execution when opening a specially crafted file (bsc#1275941). - CVE-2026-77219: integer overflow in the PBM/PPM/PGM image loader leads to heap memory content leaks when a crafted image with large dimensions and an elevated max color index is processed (bsc#1276264). - CVE-2026-79992: improper argument sanitization in TRAMP leads to arbitrary code execution via crafted filenames (bsc#1275927). Other updates and bugfixes: - Fix memory leak in wayland port (bsc#1271643).

Patchnames: openSUSE-Leap-16.0-1568

CVE-2026-77219

7.1 (High)


                
                  CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:H

Affected products

Recommended 26 products

Product	Version	Remediation
Unresolved product id: openSUSE Leap 16.0:emacs-0:30.2-160000.3.1.aarch64	—	Vendor Fix
Unresolved product id: openSUSE Leap 16.0:emacs-0:30.2-160000.3.1.ppc64le	—	Vendor Fix
Unresolved product id: openSUSE Leap 16.0:emacs-0:30.2-160000.3.1.s390x	—	Vendor Fix
Unresolved product id: openSUSE Leap 16.0:emacs-0:30.2-160000.3.1.x86_64	—	Vendor Fix
Unresolved product id: openSUSE Leap 16.0:emacs-el-0:30.2-160000.3.1.noarch	—	Vendor Fix
Unresolved product id: openSUSE Leap 16.0:emacs-eln-0:30.2-160000.3.1.aarch64	—	Vendor Fix
Unresolved product id: openSUSE Leap 16.0:emacs-eln-0:30.2-160000.3.1.ppc64le	—	Vendor Fix
Unresolved product id: openSUSE Leap 16.0:emacs-eln-0:30.2-160000.3.1.s390x	—	Vendor Fix
Unresolved product id: openSUSE Leap 16.0:emacs-eln-0:30.2-160000.3.1.x86_64	—	Vendor Fix
Unresolved product id: openSUSE Leap 16.0:emacs-games-0:30.2-160000.3.1.aarch64	—	Vendor Fix
Unresolved product id: openSUSE Leap 16.0:emacs-games-0:30.2-160000.3.1.ppc64le	—	Vendor Fix
Unresolved product id: openSUSE Leap 16.0:emacs-games-0:30.2-160000.3.1.s390x	—	Vendor Fix
Unresolved product id: openSUSE Leap 16.0:emacs-games-0:30.2-160000.3.1.x86_64	—	Vendor Fix
Unresolved product id: openSUSE Leap 16.0:emacs-info-0:30.2-160000.3.1.noarch	—	Vendor Fix
Unresolved product id: openSUSE Leap 16.0:emacs-nox-0:30.2-160000.3.1.aarch64	—	Vendor Fix
Unresolved product id: openSUSE Leap 16.0:emacs-nox-0:30.2-160000.3.1.ppc64le	—	Vendor Fix
Unresolved product id: openSUSE Leap 16.0:emacs-nox-0:30.2-160000.3.1.s390x	—	Vendor Fix
Unresolved product id: openSUSE Leap 16.0:emacs-nox-0:30.2-160000.3.1.x86_64	—	Vendor Fix
Unresolved product id: openSUSE Leap 16.0:emacs-x11-0:30.2-160000.3.1.aarch64	—	Vendor Fix
Unresolved product id: openSUSE Leap 16.0:emacs-x11-0:30.2-160000.3.1.ppc64le	—	Vendor Fix
Unresolved product id: openSUSE Leap 16.0:emacs-x11-0:30.2-160000.3.1.s390x	—	Vendor Fix
Unresolved product id: openSUSE Leap 16.0:emacs-x11-0:30.2-160000.3.1.x86_64	—	Vendor Fix
Unresolved product id: openSUSE Leap 16.0:etags-0:30.2-160000.3.1.aarch64	—	Vendor Fix
Unresolved product id: openSUSE Leap 16.0:etags-0:30.2-160000.3.1.ppc64le	—	Vendor Fix
Unresolved product id: openSUSE Leap 16.0:etags-0:30.2-160000.3.1.s390x	—	Vendor Fix
Unresolved product id: openSUSE Leap 16.0:etags-0:30.2-160000.3.1.x86_64	—	Vendor Fix

Threats

Impact important

CVE-2026-79992

7 (High)


                
                  CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H

Affected products

Recommended 26 products, the same list as for CVE-2026-77219

Threats

Impact important

References

12 references

URL	Category
https://www.suse.com/support/security/rating/	external
https://ftp.suse.com/pub/projects/security/csaf/o…	self
https://bugzilla.suse.com/1271643	self
https://bugzilla.suse.com/1275927	self
https://bugzilla.suse.com/1275941	self
https://bugzilla.suse.com/1276264	self
https://www.suse.com/security/cve/CVE-2026-77219/	self
https://www.suse.com/security/cve/CVE-2026-79992/	self
https://www.suse.com/security/cve/CVE-2026-77219	external
https://bugzilla.suse.com/1276264	external
https://www.suse.com/security/cve/CVE-2026-79992	external
https://bugzilla.suse.com/1275927	external

JSON

To clipboard

{
  "document": {
    "aggregate_severity": {
      "namespace": "https://www.suse.com/support/security/rating/",
      "text": "important"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Copyright 2024 SUSE LLC. All rights reserved.",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "Security update for emacs",
        "title": "Title of the patch"
      },
      {
        "category": "description",
        "text": "This update for emacs fixes the following issues:\n\nSecurity issues fixed:\n\n- Arbitrary code execution when opening a specially crafted file (bsc#1275941).\n- CVE-2026-77219: integer overflow in the PBM/PPM/PGM image loader leads to heap memory content leaks when a crafted\n  image with large dimensions and an elevated max color index is processed (bsc#1276264).\n- CVE-2026-79992: improper argument sanitization in TRAMP leads to arbitrary code execution via crafted filenames\n  (bsc#1275927).\n\nOther updates and bugfixes:\n\n- Fix memory leak in wayland port (bsc#1271643).\n",
        "title": "Description of the patch"
      },
      {
        "category": "details",
        "text": "openSUSE-Leap-16.0-1568",
        "title": "Patchnames"
      },
      {
        "category": "legal_disclaimer",
        "text": "CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).",
        "title": "Terms of use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://www.suse.com/support/security/contact/",
      "name": "SUSE Product Security Team",
      "namespace": "https://www.suse.com/"
    },
    "references": [
      {
        "category": "external",
        "summary": "SUSE ratings",
        "url": "https://www.suse.com/support/security/rating/"
      },
      {
        "category": "self",
        "summary": "URL of this CSAF notice",
        "url": "https://ftp.suse.com/pub/projects/security/csaf/opensuse-su-2026_21711-1.json"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1271643",
        "url": "https://bugzilla.suse.com/1271643"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1275927",
        "url": "https://bugzilla.suse.com/1275927"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1275941",
        "url": "https://bugzilla.suse.com/1275941"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1276264",
        "url": "https://bugzilla.suse.com/1276264"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2026-77219 page",
        "url": "https://www.suse.com/security/cve/CVE-2026-77219/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2026-79992 page",
        "url": "https://www.suse.com/security/cve/CVE-2026-79992/"
      }
    ],
    "title": "Security update for emacs",
    "tracking": {
      "current_release_date": "2026-09-17T17:43:08Z",
      "generator": {
        "date": "2026-08-31T11:49:39Z",
        "engine": {
          "name": "cve-database.git:bin/generate-csaf.pl",
          "version": "1"
        }
      },
      "id": "openSUSE-SU-2026:21711-1",
      "initial_release_date": "2026-08-31T11:49:39Z",
      "revision_history": [
        {
          "date": "2026-08-31T11:49:39Z",
          "number": "1",
          "summary": "Current version"
        },
        {
          "date": "2026-09-16T20:46:41Z",
          "number": "2",
          "summary": "unknown changes"
        },
        {
          "date": "2026-09-16T21:47:36Z",
          "number": "3",
          "summary": "unknown changes"
        },
        {
          "date": "2026-09-17T17:43:08Z",
          "number": "4",
          "summary": "unknown changes"
        }
      ],
      "status": "final",
      "version": "4"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_version",
                "name": "emacs-0:30.2-160000.3.1.aarch64",
                "product": {
                  "name": "emacs-0:30.2-160000.3.1.aarch64",
                  "product_id": "emacs-0:30.2-160000.3.1.aarch64",
                  "product_identification_helper": {
                    "cpe": "cpe:2.3:a:gnu:emacs:30.2:*:*:*:*:*:*:*",
                    "purl": "pkg:rpm/suse/emacs@30.2-160000.3.1?arch=aarch64\u0026upstream=emacs-0:30.2-160000.3.1.src.rpm"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "emacs-eln-0:30.2-160000.3.1.aarch64",
                "product": {
                  "name": "emacs-eln-0:30.2-160000.3.1.aarch64",
                  "product_id": "emacs-eln-0:30.2-160000.3.1.aarch64",
                  "product_identification_helper": {
                    "cpe": "cpe:2.3:a:gnu:emacs:30.2:*:*:*:*:*:*:*",
                    "purl": "pkg:rpm/suse/emacs-eln@30.2-160000.3.1?arch=aarch64\u0026upstream=emacs-0:30.2-160000.3.1.src.rpm"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "emacs-games-0:30.2-160000.3.1.aarch64",
                "product": {
                  "name": "emacs-games-0:30.2-160000.3.1.aarch64",
                  "product_id": "emacs-games-0:30.2-160000.3.1.aarch64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/suse/emacs-games@30.2-160000.3.1?arch=aarch64"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "emacs-nox-0:30.2-160000.3.1.aarch64",
                "product": {
                  "name": "emacs-nox-0:30.2-160000.3.1.aarch64",
                  "product_id": "emacs-nox-0:30.2-160000.3.1.aarch64",
                  "product_identification_helper": {
                    "cpe": "cpe:2.3:a:gnu:emacs:30.2:*:*:*:*:*:*:*",
                    "purl": "pkg:rpm/suse/emacs-nox@30.2-160000.3.1?arch=aarch64\u0026upstream=emacs-0:30.2-160000.3.1.src.rpm"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "emacs-x11-0:30.2-160000.3.1.aarch64",
                "product": {
                  "name": "emacs-x11-0:30.2-160000.3.1.aarch64",
                  "product_id": "emacs-x11-0:30.2-160000.3.1.aarch64",
                  "product_identification_helper": {
                    "cpe": "cpe:2.3:a:gnu:emacs:30.2:*:*:*:*:*:*:*",
                    "purl": "pkg:rpm/suse/emacs-x11@30.2-160000.3.1?arch=aarch64\u0026upstream=emacs-0:30.2-160000.3.1.src.rpm"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "etags-0:30.2-160000.3.1.aarch64",
                "product": {
                  "name": "etags-0:30.2-160000.3.1.aarch64",
                  "product_id": "etags-0:30.2-160000.3.1.aarch64",
                  "product_identification_helper": {
                    "cpe": "cpe:2.3:a:gnu:emacs:30.2:*:*:*:*:*:*:*",
                    "purl": "pkg:rpm/suse/etags@30.2-160000.3.1?arch=aarch64\u0026upstream=emacs-0:30.2-160000.3.1.src.rpm"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "aarch64"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "emacs-el-0:30.2-160000.3.1.noarch",
                "product": {
                  "name": "emacs-el-0:30.2-160000.3.1.noarch",
                  "product_id": "emacs-el-0:30.2-160000.3.1.noarch",
                  "product_identification_helper": {
                    "cpe": "cpe:2.3:a:gnu:emacs:30.2:*:*:*:*:*:*:*",
                    "purl": "pkg:rpm/suse/emacs-el@30.2-160000.3.1?arch=noarch\u0026upstream=emacs-0:30.2-160000.3.1.src.rpm"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "emacs-info-0:30.2-160000.3.1.noarch",
                "product": {
                  "name": "emacs-info-0:30.2-160000.3.1.noarch",
                  "product_id": "emacs-info-0:30.2-160000.3.1.noarch",
                  "product_identification_helper": {
                    "cpe": "cpe:2.3:a:gnu:emacs:30.2:*:*:*:*:*:*:*",
                    "purl": "pkg:rpm/suse/emacs-info@30.2-160000.3.1?arch=noarch\u0026upstream=emacs-0:30.2-160000.3.1.src.rpm"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "noarch"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "emacs-0:30.2-160000.3.1.ppc64le",
                "product": {
                  "name": "emacs-0:30.2-160000.3.1.ppc64le",
                  "product_id": "emacs-0:30.2-160000.3.1.ppc64le",
                  "product_identification_helper": {
                    "cpe": "cpe:2.3:a:gnu:emacs:30.2:*:*:*:*:*:*:*",
                    "purl": "pkg:rpm/suse/emacs@30.2-160000.3.1?arch=ppc64le\u0026upstream=emacs-0:30.2-160000.3.1.src.rpm"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "emacs-eln-0:30.2-160000.3.1.ppc64le",
                "product": {
                  "name": "emacs-eln-0:30.2-160000.3.1.ppc64le",
                  "product_id": "emacs-eln-0:30.2-160000.3.1.ppc64le",
                  "product_identification_helper": {
                    "cpe": "cpe:2.3:a:gnu:emacs:30.2:*:*:*:*:*:*:*",
                    "purl": "pkg:rpm/suse/emacs-eln@30.2-160000.3.1?arch=ppc64le\u0026upstream=emacs-0:30.2-160000.3.1.src.rpm"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "emacs-games-0:30.2-160000.3.1.ppc64le",
                "product": {
                  "name": "emacs-games-0:30.2-160000.3.1.ppc64le",
                  "product_id": "emacs-games-0:30.2-160000.3.1.ppc64le",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/suse/emacs-games@30.2-160000.3.1?arch=ppc64le"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "emacs-nox-0:30.2-160000.3.1.ppc64le",
                "product": {
                  "name": "emacs-nox-0:30.2-160000.3.1.ppc64le",
                  "product_id": "emacs-nox-0:30.2-160000.3.1.ppc64le",
                  "product_identification_helper": {
                    "cpe": "cpe:2.3:a:gnu:emacs:30.2:*:*:*:*:*:*:*",
                    "purl": "pkg:rpm/suse/emacs-nox@30.2-160000.3.1?arch=ppc64le\u0026upstream=emacs-0:30.2-160000.3.1.src.rpm"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "emacs-x11-0:30.2-160000.3.1.ppc64le",
                "product": {
                  "name": "emacs-x11-0:30.2-160000.3.1.ppc64le",
                  "product_id": "emacs-x11-0:30.2-160000.3.1.ppc64le",
                  "product_identification_helper": {
                    "cpe": "cpe:2.3:a:gnu:emacs:30.2:*:*:*:*:*:*:*",
                    "purl": "pkg:rpm/suse/emacs-x11@30.2-160000.3.1?arch=ppc64le\u0026upstream=emacs-0:30.2-160000.3.1.src.rpm"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "etags-0:30.2-160000.3.1.ppc64le",
                "product": {
                  "name": "etags-0:30.2-160000.3.1.ppc64le",
                  "product_id": "etags-0:30.2-160000.3.1.ppc64le",
                  "product_identification_helper": {
                    "cpe": "cpe:2.3:a:gnu:emacs:30.2:*:*:*:*:*:*:*",
                    "purl": "pkg:rpm/suse/etags@30.2-160000.3.1?arch=ppc64le\u0026upstream=emacs-0:30.2-160000.3.1.src.rpm"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "ppc64le"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "emacs-0:30.2-160000.3.1.s390x",
                "product": {
                  "name": "emacs-0:30.2-160000.3.1.s390x",
                  "product_id": "emacs-0:30.2-160000.3.1.s390x",
                  "product_identification_helper": {
                    "cpe": "cpe:2.3:a:gnu:emacs:30.2:*:*:*:*:*:*:*",
                    "purl": "pkg:rpm/suse/emacs@30.2-160000.3.1?arch=s390x\u0026upstream=emacs-0:30.2-160000.3.1.src.rpm"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "emacs-eln-0:30.2-160000.3.1.s390x",
                "product": {
                  "name": "emacs-eln-0:30.2-160000.3.1.s390x",
                  "product_id": "emacs-eln-0:30.2-160000.3.1.s390x",
                  "product_identification_helper": {
                    "cpe": "cpe:2.3:a:gnu:emacs:30.2:*:*:*:*:*:*:*",
                    "purl": "pkg:rpm/suse/emacs-eln@30.2-160000.3.1?arch=s390x\u0026upstream=emacs-0:30.2-160000.3.1.src.rpm"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "emacs-games-0:30.2-160000.3.1.s390x",
                "product": {
                  "name": "emacs-games-0:30.2-160000.3.1.s390x",
                  "product_id": "emacs-games-0:30.2-160000.3.1.s390x",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/suse/emacs-games@30.2-160000.3.1?arch=s390x"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "emacs-nox-0:30.2-160000.3.1.s390x",
                "product": {
                  "name": "emacs-nox-0:30.2-160000.3.1.s390x",
                  "product_id": "emacs-nox-0:30.2-160000.3.1.s390x",
                  "product_identification_helper": {
                    "cpe": "cpe:2.3:a:gnu:emacs:30.2:*:*:*:*:*:*:*",
                    "purl": "pkg:rpm/suse/emacs-nox@30.2-160000.3.1?arch=s390x\u0026upstream=emacs-0:30.2-160000.3.1.src.rpm"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "emacs-x11-0:30.2-160000.3.1.s390x",
                "product": {
                  "name": "emacs-x11-0:30.2-160000.3.1.s390x",
                  "product_id": "emacs-x11-0:30.2-160000.3.1.s390x",
                  "product_identification_helper": {
                    "cpe": "cpe:2.3:a:gnu:emacs:30.2:*:*:*:*:*:*:*",
                    "purl": "pkg:rpm/suse/emacs-x11@30.2-160000.3.1?arch=s390x\u0026upstream=emacs-0:30.2-160000.3.1.src.rpm"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "etags-0:30.2-160000.3.1.s390x",
                "product": {
                  "name": "etags-0:30.2-160000.3.1.s390x",
                  "product_id": "etags-0:30.2-160000.3.1.s390x",
                  "product_identification_helper": {
                    "cpe": "cpe:2.3:a:gnu:emacs:30.2:*:*:*:*:*:*:*",
                    "purl": "pkg:rpm/suse/etags@30.2-160000.3.1?arch=s390x\u0026upstream=emacs-0:30.2-160000.3.1.src.rpm"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "s390x"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "emacs-0:30.2-160000.3.1.x86_64",
                "product": {
                  "name": "emacs-0:30.2-160000.3.1.x86_64",
                  "product_id": "emacs-0:30.2-160000.3.1.x86_64",
                  "product_identification_helper": {
                    "cpe": "cpe:2.3:a:gnu:emacs:30.2:*:*:*:*:*:*:*",
                    "purl": "pkg:rpm/suse/emacs@30.2-160000.3.1?arch=x86_64\u0026upstream=emacs-0:30.2-160000.3.1.src.rpm"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "emacs-eln-0:30.2-160000.3.1.x86_64",
                "product": {
                  "name": "emacs-eln-0:30.2-160000.3.1.x86_64",
                  "product_id": "emacs-eln-0:30.2-160000.3.1.x86_64",
                  "product_identification_helper": {
                    "cpe": "cpe:2.3:a:gnu:emacs:30.2:*:*:*:*:*:*:*",
                    "purl": "pkg:rpm/suse/emacs-eln@30.2-160000.3.1?arch=x86_64\u0026upstream=emacs-0:30.2-160000.3.1.src.rpm"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "emacs-games-0:30.2-160000.3.1.x86_64",
                "product": {
                  "name": "emacs-games-0:30.2-160000.3.1.x86_64",
                  "product_id": "emacs-games-0:30.2-160000.3.1.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/suse/emacs-games@30.2-160000.3.1?arch=x86_64"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "emacs-nox-0:30.2-160000.3.1.x86_64",
                "product": {
                  "name": "emacs-nox-0:30.2-160000.3.1.x86_64",
                  "product_id": "emacs-nox-0:30.2-160000.3.1.x86_64",
                  "product_identification_helper": {
                    "cpe": "cpe:2.3:a:gnu:emacs:30.2:*:*:*:*:*:*:*",
                    "purl": "pkg:rpm/suse/emacs-nox@30.2-160000.3.1?arch=x86_64\u0026upstream=emacs-0:30.2-160000.3.1.src.rpm"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "emacs-x11-0:30.2-160000.3.1.x86_64",
                "product": {
                  "name": "emacs-x11-0:30.2-160000.3.1.x86_64",
                  "product_id": "emacs-x11-0:30.2-160000.3.1.x86_64",
                  "product_identification_helper": {
                    "cpe": "cpe:2.3:a:gnu:emacs:30.2:*:*:*:*:*:*:*",
                    "purl": "pkg:rpm/suse/emacs-x11@30.2-160000.3.1?arch=x86_64\u0026upstream=emacs-0:30.2-160000.3.1.src.rpm"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "etags-0:30.2-160000.3.1.x86_64",
                "product": {
                  "name": "etags-0:30.2-160000.3.1.x86_64",
                  "product_id": "etags-0:30.2-160000.3.1.x86_64",
                  "product_identification_helper": {
                    "cpe": "cpe:2.3:a:gnu:emacs:30.2:*:*:*:*:*:*:*",
                    "purl": "pkg:rpm/suse/etags@30.2-160000.3.1?arch=x86_64\u0026upstream=emacs-0:30.2-160000.3.1.src.rpm"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "x86_64"
          },
          {
            "branches": [
              {
                "category": "product_name",
                "name": "openSUSE Leap 16.0",
                "product": {
                  "name": "openSUSE Leap 16.0",
                  "product_id": "openSUSE Leap 16.0"
                }
              }
            ],
            "category": "product_family",
            "name": "SUSE Linux Enterprise"
          }
        ],
        "category": "vendor",
        "name": "SUSE"
      }
    ],
    "relationships": [
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "emacs-0:30.2-160000.3.1.aarch64 as component of openSUSE Leap 16.0",
          "product_id": "openSUSE Leap 16.0:emacs-0:30.2-160000.3.1.aarch64"
        },
        "product_reference": "emacs-0:30.2-160000.3.1.aarch64",
        "relates_to_product_reference": "openSUSE Leap 16.0"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "emacs-0:30.2-160000.3.1.ppc64le as component of openSUSE Leap 16.0",
          "product_id": "openSUSE Leap 16.0:emacs-0:30.2-160000.3.1.ppc64le"
        },
        "product_reference": "emacs-0:30.2-160000.3.1.ppc64le",
        "relates_to_product_reference": "openSUSE Leap 16.0"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "emacs-0:30.2-160000.3.1.s390x as component of openSUSE Leap 16.0",
          "product_id": "openSUSE Leap 16.0:emacs-0:30.2-160000.3.1.s390x"
        },
        "product_reference": "emacs-0:30.2-160000.3.1.s390x",
        "relates_to_product_reference": "openSUSE Leap 16.0"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "emacs-0:30.2-160000.3.1.x86_64 as component of openSUSE Leap 16.0",
          "product_id": "openSUSE Leap 16.0:emacs-0:30.2-160000.3.1.x86_64"
        },
        "product_reference": "emacs-0:30.2-160000.3.1.x86_64",
        "relates_to_product_reference": "openSUSE Leap 16.0"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "emacs-el-0:30.2-160000.3.1.noarch as component of openSUSE Leap 16.0",
          "product_id": "openSUSE Leap 16.0:emacs-el-0:30.2-160000.3.1.noarch"
        },
        "product_reference": "emacs-el-0:30.2-160000.3.1.noarch",
        "relates_to_product_reference": "openSUSE Leap 16.0"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "emacs-eln-0:30.2-160000.3.1.aarch64 as component of openSUSE Leap 16.0",
          "product_id": "openSUSE Leap 16.0:emacs-eln-0:30.2-160000.3.1.aarch64"
        },
        "product_reference": "emacs-eln-0:30.2-160000.3.1.aarch64",
        "relates_to_product_reference": "openSUSE Leap 16.0"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "emacs-eln-0:30.2-160000.3.1.ppc64le as component of openSUSE Leap 16.0",
          "product_id": "openSUSE Leap 16.0:emacs-eln-0:30.2-160000.3.1.ppc64le"
        },
        "product_reference": "emacs-eln-0:30.2-160000.3.1.ppc64le",
        "relates_to_product_reference": "openSUSE Leap 16.0"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "emacs-eln-0:30.2-160000.3.1.s390x as component of openSUSE Leap 16.0",
          "product_id": "openSUSE Leap 16.0:emacs-eln-0:30.2-160000.3.1.s390x"
        },
        "product_reference": "emacs-eln-0:30.2-160000.3.1.s390x",
        "relates_to_product_reference": "openSUSE Leap 16.0"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "emacs-eln-0:30.2-160000.3.1.x86_64 as component of openSUSE Leap 16.0",
          "product_id": "openSUSE Leap 16.0:emacs-eln-0:30.2-160000.3.1.x86_64"
        },
        "product_reference": "emacs-eln-0:30.2-160000.3.1.x86_64",
        "relates_to_product_reference": "openSUSE Leap 16.0"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "emacs-games-0:30.2-160000.3.1.aarch64 as component of openSUSE Leap 16.0",
          "product_id": "openSUSE Leap 16.0:emacs-games-0:30.2-160000.3.1.aarch64"
        },
        "product_reference": "emacs-games-0:30.2-160000.3.1.aarch64",
        "relates_to_product_reference": "openSUSE Leap 16.0"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "emacs-games-0:30.2-160000.3.1.ppc64le as component of openSUSE Leap 16.0",
          "product_id": "openSUSE Leap 16.0:emacs-games-0:30.2-160000.3.1.ppc64le"
        },
        "product_reference": "emacs-games-0:30.2-160000.3.1.ppc64le",
        "relates_to_product_reference": "openSUSE Leap 16.0"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "emacs-games-0:30.2-160000.3.1.s390x as component of openSUSE Leap 16.0",
          "product_id": "openSUSE Leap 16.0:emacs-games-0:30.2-160000.3.1.s390x"
        },
        "product_reference": "emacs-games-0:30.2-160000.3.1.s390x",
        "relates_to_product_reference": "openSUSE Leap 16.0"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "emacs-games-0:30.2-160000.3.1.x86_64 as component of openSUSE Leap 16.0",
          "product_id": "openSUSE Leap 16.0:emacs-games-0:30.2-160000.3.1.x86_64"
        },
        "product_reference": "emacs-games-0:30.2-160000.3.1.x86_64",
        "relates_to_product_reference": "openSUSE Leap 16.0"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "emacs-info-0:30.2-160000.3.1.noarch as component of openSUSE Leap 16.0",
          "product_id": "openSUSE Leap 16.0:emacs-info-0:30.2-160000.3.1.noarch"
        },
        "product_reference": "emacs-info-0:30.2-160000.3.1.noarch",
        "relates_to_product_reference": "openSUSE Leap 16.0"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "emacs-nox-0:30.2-160000.3.1.aarch64 as component of openSUSE Leap 16.0",
          "product_id": "openSUSE Leap 16.0:emacs-nox-0:30.2-160000.3.1.aarch64"
        },
        "product_reference": "emacs-nox-0:30.2-160000.3.1.aarch64",
        "relates_to_product_reference": "openSUSE Leap 16.0"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "emacs-nox-0:30.2-160000.3.1.ppc64le as component of openSUSE Leap 16.0",
          "product_id": "openSUSE Leap 16.0:emacs-nox-0:30.2-160000.3.1.ppc64le"
        },
        "product_reference": "emacs-nox-0:30.2-160000.3.1.ppc64le",
        "relates_to_product_reference": "openSUSE Leap 16.0"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "emacs-nox-0:30.2-160000.3.1.s390x as component of openSUSE Leap 16.0",
          "product_id": "openSUSE Leap 16.0:emacs-nox-0:30.2-160000.3.1.s390x"
        },
        "product_reference": "emacs-nox-0:30.2-160000.3.1.s390x",
        "relates_to_product_reference": "openSUSE Leap 16.0"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "emacs-nox-0:30.2-160000.3.1.x86_64 as component of openSUSE Leap 16.0",
          "product_id": "openSUSE Leap 16.0:emacs-nox-0:30.2-160000.3.1.x86_64"
        },
        "product_reference": "emacs-nox-0:30.2-160000.3.1.x86_64",
        "relates_to_product_reference": "openSUSE Leap 16.0"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "emacs-x11-0:30.2-160000.3.1.aarch64 as component of openSUSE Leap 16.0",
          "product_id": "openSUSE Leap 16.0:emacs-x11-0:30.2-160000.3.1.aarch64"
        },
        "product_reference": "emacs-x11-0:30.2-160000.3.1.aarch64",
        "relates_to_product_reference": "openSUSE Leap 16.0"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "emacs-x11-0:30.2-160000.3.1.ppc64le as component of openSUSE Leap 16.0",
          "product_id": "openSUSE Leap 16.0:emacs-x11-0:30.2-160000.3.1.ppc64le"
        },
        "product_reference": "emacs-x11-0:30.2-160000.3.1.ppc64le",
        "relates_to_product_reference": "openSUSE Leap 16.0"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "emacs-x11-0:30.2-160000.3.1.s390x as component of openSUSE Leap 16.0",
          "product_id": "openSUSE Leap 16.0:emacs-x11-0:30.2-160000.3.1.s390x"
        },
        "product_reference": "emacs-x11-0:30.2-160000.3.1.s390x",
        "relates_to_product_reference": "openSUSE Leap 16.0"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "emacs-x11-0:30.2-160000.3.1.x86_64 as component of openSUSE Leap 16.0",
          "product_id": "openSUSE Leap 16.0:emacs-x11-0:30.2-160000.3.1.x86_64"
        },
        "product_reference": "emacs-x11-0:30.2-160000.3.1.x86_64",
        "relates_to_product_reference": "openSUSE Leap 16.0"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "etags-0:30.2-160000.3.1.aarch64 as component of openSUSE Leap 16.0",
          "product_id": "openSUSE Leap 16.0:etags-0:30.2-160000.3.1.aarch64"
        },
        "product_reference": "etags-0:30.2-160000.3.1.aarch64",
        "relates_to_product_reference": "openSUSE Leap 16.0"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "etags-0:30.2-160000.3.1.ppc64le as component of openSUSE Leap 16.0",
          "product_id": "openSUSE Leap 16.0:etags-0:30.2-160000.3.1.ppc64le"
        },
        "product_reference": "etags-0:30.2-160000.3.1.ppc64le",
        "relates_to_product_reference": "openSUSE Leap 16.0"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "etags-0:30.2-160000.3.1.s390x as component of openSUSE Leap 16.0",
          "product_id": "openSUSE Leap 16.0:etags-0:30.2-160000.3.1.s390x"
        },
        "product_reference": "etags-0:30.2-160000.3.1.s390x",
        "relates_to_product_reference": "openSUSE Leap 16.0"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "etags-0:30.2-160000.3.1.x86_64 as component of openSUSE Leap 16.0",
          "product_id": "openSUSE Leap 16.0:etags-0:30.2-160000.3.1.x86_64"
        },
        "product_reference": "etags-0:30.2-160000.3.1.x86_64",
        "relates_to_product_reference": "openSUSE Leap 16.0"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2026-77219",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2026-77219"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "GNU Emacs before 31.0.91 contains an integer overflow in the PBM/PPM/PGM image loader that allows an attacker to leak heap memory contents by supplying a crafted image with large dimensions and an elevated max color index. The image loader multiplies image dimensions and channel count using signed integer arithmetic; for sufficiently large values, the result wraps to a negative number, bypassing the bounds check and causing the pixel reader to access heap memory past the end of the allocated buffer. The over-read contents are interpreted as pixel color values and rendered on screen.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Leap 16.0:emacs-0:30.2-160000.3.1.aarch64",
          "openSUSE Leap 16.0:emacs-0:30.2-160000.3.1.ppc64le",
          "openSUSE Leap 16.0:emacs-0:30.2-160000.3.1.s390x",
          "openSUSE Leap 16.0:emacs-0:30.2-160000.3.1.x86_64",
          "openSUSE Leap 16.0:emacs-el-0:30.2-160000.3.1.noarch",
          "openSUSE Leap 16.0:emacs-eln-0:30.2-160000.3.1.aarch64",
          "openSUSE Leap 16.0:emacs-eln-0:30.2-160000.3.1.ppc64le",
          "openSUSE Leap 16.0:emacs-eln-0:30.2-160000.3.1.s390x",
          "openSUSE Leap 16.0:emacs-eln-0:30.2-160000.3.1.x86_64",
          "openSUSE Leap 16.0:emacs-games-0:30.2-160000.3.1.aarch64",
          "openSUSE Leap 16.0:emacs-games-0:30.2-160000.3.1.ppc64le",
          "openSUSE Leap 16.0:emacs-games-0:30.2-160000.3.1.s390x",
          "openSUSE Leap 16.0:emacs-games-0:30.2-160000.3.1.x86_64",
          "openSUSE Leap 16.0:emacs-info-0:30.2-160000.3.1.noarch",
          "openSUSE Leap 16.0:emacs-nox-0:30.2-160000.3.1.aarch64",
          "openSUSE Leap 16.0:emacs-nox-0:30.2-160000.3.1.ppc64le",
          "openSUSE Leap 16.0:emacs-nox-0:30.2-160000.3.1.s390x",
          "openSUSE Leap 16.0:emacs-nox-0:30.2-160000.3.1.x86_64",
          "openSUSE Leap 16.0:emacs-x11-0:30.2-160000.3.1.aarch64",
          "openSUSE Leap 16.0:emacs-x11-0:30.2-160000.3.1.ppc64le",
          "openSUSE Leap 16.0:emacs-x11-0:30.2-160000.3.1.s390x",
          "openSUSE Leap 16.0:emacs-x11-0:30.2-160000.3.1.x86_64",
          "openSUSE Leap 16.0:etags-0:30.2-160000.3.1.aarch64",
          "openSUSE Leap 16.0:etags-0:30.2-160000.3.1.ppc64le",
          "openSUSE Leap 16.0:etags-0:30.2-160000.3.1.s390x",
          "openSUSE Leap 16.0:etags-0:30.2-160000.3.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2026-77219",
          "url": "https://www.suse.com/security/cve/CVE-2026-77219"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1276264 for CVE-2026-77219",
          "url": "https://bugzilla.suse.com/1276264"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Leap 16.0:emacs-0:30.2-160000.3.1.aarch64",
            "openSUSE Leap 16.0:emacs-0:30.2-160000.3.1.ppc64le",
            "openSUSE Leap 16.0:emacs-0:30.2-160000.3.1.s390x",
            "openSUSE Leap 16.0:emacs-0:30.2-160000.3.1.x86_64",
            "openSUSE Leap 16.0:emacs-el-0:30.2-160000.3.1.noarch",
            "openSUSE Leap 16.0:emacs-eln-0:30.2-160000.3.1.aarch64",
            "openSUSE Leap 16.0:emacs-eln-0:30.2-160000.3.1.ppc64le",
            "openSUSE Leap 16.0:emacs-eln-0:30.2-160000.3.1.s390x",
            "openSUSE Leap 16.0:emacs-eln-0:30.2-160000.3.1.x86_64",
            "openSUSE Leap 16.0:emacs-games-0:30.2-160000.3.1.aarch64",
            "openSUSE Leap 16.0:emacs-games-0:30.2-160000.3.1.ppc64le",
            "openSUSE Leap 16.0:emacs-games-0:30.2-160000.3.1.s390x",
            "openSUSE Leap 16.0:emacs-games-0:30.2-160000.3.1.x86_64",
            "openSUSE Leap 16.0:emacs-info-0:30.2-160000.3.1.noarch",
            "openSUSE Leap 16.0:emacs-nox-0:30.2-160000.3.1.aarch64",
            "openSUSE Leap 16.0:emacs-nox-0:30.2-160000.3.1.ppc64le",
            "openSUSE Leap 16.0:emacs-nox-0:30.2-160000.3.1.s390x",
            "openSUSE Leap 16.0:emacs-nox-0:30.2-160000.3.1.x86_64",
            "openSUSE Leap 16.0:emacs-x11-0:30.2-160000.3.1.aarch64",
            "openSUSE Leap 16.0:emacs-x11-0:30.2-160000.3.1.ppc64le",
            "openSUSE Leap 16.0:emacs-x11-0:30.2-160000.3.1.s390x",
            "openSUSE Leap 16.0:emacs-x11-0:30.2-160000.3.1.x86_64",
            "openSUSE Leap 16.0:etags-0:30.2-160000.3.1.aarch64",
            "openSUSE Leap 16.0:etags-0:30.2-160000.3.1.ppc64le",
            "openSUSE Leap 16.0:etags-0:30.2-160000.3.1.s390x",
            "openSUSE Leap 16.0:etags-0:30.2-160000.3.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.1,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "openSUSE Leap 16.0:emacs-0:30.2-160000.3.1.aarch64",
            "openSUSE Leap 16.0:emacs-0:30.2-160000.3.1.ppc64le",
            "openSUSE Leap 16.0:emacs-0:30.2-160000.3.1.s390x",
            "openSUSE Leap 16.0:emacs-0:30.2-160000.3.1.x86_64",
            "openSUSE Leap 16.0:emacs-el-0:30.2-160000.3.1.noarch",
            "openSUSE Leap 16.0:emacs-eln-0:30.2-160000.3.1.aarch64",
            "openSUSE Leap 16.0:emacs-eln-0:30.2-160000.3.1.ppc64le",
            "openSUSE Leap 16.0:emacs-eln-0:30.2-160000.3.1.s390x",
            "openSUSE Leap 16.0:emacs-eln-0:30.2-160000.3.1.x86_64",
            "openSUSE Leap 16.0:emacs-games-0:30.2-160000.3.1.aarch64",
            "openSUSE Leap 16.0:emacs-games-0:30.2-160000.3.1.ppc64le",
            "openSUSE Leap 16.0:emacs-games-0:30.2-160000.3.1.s390x",
            "openSUSE Leap 16.0:emacs-games-0:30.2-160000.3.1.x86_64",
            "openSUSE Leap 16.0:emacs-info-0:30.2-160000.3.1.noarch",
            "openSUSE Leap 16.0:emacs-nox-0:30.2-160000.3.1.aarch64",
            "openSUSE Leap 16.0:emacs-nox-0:30.2-160000.3.1.ppc64le",
            "openSUSE Leap 16.0:emacs-nox-0:30.2-160000.3.1.s390x",
            "openSUSE Leap 16.0:emacs-nox-0:30.2-160000.3.1.x86_64",
            "openSUSE Leap 16.0:emacs-x11-0:30.2-160000.3.1.aarch64",
            "openSUSE Leap 16.0:emacs-x11-0:30.2-160000.3.1.ppc64le",
            "openSUSE Leap 16.0:emacs-x11-0:30.2-160000.3.1.s390x",
            "openSUSE Leap 16.0:emacs-x11-0:30.2-160000.3.1.x86_64",
            "openSUSE Leap 16.0:etags-0:30.2-160000.3.1.aarch64",
            "openSUSE Leap 16.0:etags-0:30.2-160000.3.1.ppc64le",
            "openSUSE Leap 16.0:etags-0:30.2-160000.3.1.s390x",
            "openSUSE Leap 16.0:etags-0:30.2-160000.3.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2026-08-31T11:49:39Z",
          "details": "important"
        }
      ],
      "title": "CVE-2026-77219"
    },
    {
      "cve": "CVE-2026-79992",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2026-79992"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "A flaw was found in Emacs TRAMP. A local attacker could exploit this vulnerability by processing maliciously crafted filenames. This occurs because TRAMP concatenates login arguments without proper sanitization, which are then passed to a local shell. Successful exploitation could lead to arbitrary code execution.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Leap 16.0:emacs-0:30.2-160000.3.1.aarch64",
          "openSUSE Leap 16.0:emacs-0:30.2-160000.3.1.ppc64le",
          "openSUSE Leap 16.0:emacs-0:30.2-160000.3.1.s390x",
          "openSUSE Leap 16.0:emacs-0:30.2-160000.3.1.x86_64",
          "openSUSE Leap 16.0:emacs-el-0:30.2-160000.3.1.noarch",
          "openSUSE Leap 16.0:emacs-eln-0:30.2-160000.3.1.aarch64",
          "openSUSE Leap 16.0:emacs-eln-0:30.2-160000.3.1.ppc64le",
          "openSUSE Leap 16.0:emacs-eln-0:30.2-160000.3.1.s390x",
          "openSUSE Leap 16.0:emacs-eln-0:30.2-160000.3.1.x86_64",
          "openSUSE Leap 16.0:emacs-games-0:30.2-160000.3.1.aarch64",
          "openSUSE Leap 16.0:emacs-games-0:30.2-160000.3.1.ppc64le",
          "openSUSE Leap 16.0:emacs-games-0:30.2-160000.3.1.s390x",
          "openSUSE Leap 16.0:emacs-games-0:30.2-160000.3.1.x86_64",
          "openSUSE Leap 16.0:emacs-info-0:30.2-160000.3.1.noarch",
          "openSUSE Leap 16.0:emacs-nox-0:30.2-160000.3.1.aarch64",
          "openSUSE Leap 16.0:emacs-nox-0:30.2-160000.3.1.ppc64le",
          "openSUSE Leap 16.0:emacs-nox-0:30.2-160000.3.1.s390x",
          "openSUSE Leap 16.0:emacs-nox-0:30.2-160000.3.1.x86_64",
          "openSUSE Leap 16.0:emacs-x11-0:30.2-160000.3.1.aarch64",
          "openSUSE Leap 16.0:emacs-x11-0:30.2-160000.3.1.ppc64le",
          "openSUSE Leap 16.0:emacs-x11-0:30.2-160000.3.1.s390x",
          "openSUSE Leap 16.0:emacs-x11-0:30.2-160000.3.1.x86_64",
          "openSUSE Leap 16.0:etags-0:30.2-160000.3.1.aarch64",
          "openSUSE Leap 16.0:etags-0:30.2-160000.3.1.ppc64le",
          "openSUSE Leap 16.0:etags-0:30.2-160000.3.1.s390x",
          "openSUSE Leap 16.0:etags-0:30.2-160000.3.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2026-79992",
          "url": "https://www.suse.com/security/cve/CVE-2026-79992"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1275927 for CVE-2026-79992",
          "url": "https://bugzilla.suse.com/1275927"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Leap 16.0:emacs-0:30.2-160000.3.1.aarch64",
            "openSUSE Leap 16.0:emacs-0:30.2-160000.3.1.ppc64le",
            "openSUSE Leap 16.0:emacs-0:30.2-160000.3.1.s390x",
            "openSUSE Leap 16.0:emacs-0:30.2-160000.3.1.x86_64",
            "openSUSE Leap 16.0:emacs-el-0:30.2-160000.3.1.noarch",
            "openSUSE Leap 16.0:emacs-eln-0:30.2-160000.3.1.aarch64",
            "openSUSE Leap 16.0:emacs-eln-0:30.2-160000.3.1.ppc64le",
            "openSUSE Leap 16.0:emacs-eln-0:30.2-160000.3.1.s390x",
            "openSUSE Leap 16.0:emacs-eln-0:30.2-160000.3.1.x86_64",
            "openSUSE Leap 16.0:emacs-games-0:30.2-160000.3.1.aarch64",
            "openSUSE Leap 16.0:emacs-games-0:30.2-160000.3.1.ppc64le",
            "openSUSE Leap 16.0:emacs-games-0:30.2-160000.3.1.s390x",
            "openSUSE Leap 16.0:emacs-games-0:30.2-160000.3.1.x86_64",
            "openSUSE Leap 16.0:emacs-info-0:30.2-160000.3.1.noarch",
            "openSUSE Leap 16.0:emacs-nox-0:30.2-160000.3.1.aarch64",
            "openSUSE Leap 16.0:emacs-nox-0:30.2-160000.3.1.ppc64le",
            "openSUSE Leap 16.0:emacs-nox-0:30.2-160000.3.1.s390x",
            "openSUSE Leap 16.0:emacs-nox-0:30.2-160000.3.1.x86_64",
            "openSUSE Leap 16.0:emacs-x11-0:30.2-160000.3.1.aarch64",
            "openSUSE Leap 16.0:emacs-x11-0:30.2-160000.3.1.ppc64le",
            "openSUSE Leap 16.0:emacs-x11-0:30.2-160000.3.1.s390x",
            "openSUSE Leap 16.0:emacs-x11-0:30.2-160000.3.1.x86_64",
            "openSUSE Leap 16.0:etags-0:30.2-160000.3.1.aarch64",
            "openSUSE Leap 16.0:etags-0:30.2-160000.3.1.ppc64le",
            "openSUSE Leap 16.0:etags-0:30.2-160000.3.1.s390x",
            "openSUSE Leap 16.0:etags-0:30.2-160000.3.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "openSUSE Leap 16.0:emacs-0:30.2-160000.3.1.aarch64",
            "openSUSE Leap 16.0:emacs-0:30.2-160000.3.1.ppc64le",
            "openSUSE Leap 16.0:emacs-0:30.2-160000.3.1.s390x",
            "openSUSE Leap 16.0:emacs-0:30.2-160000.3.1.x86_64",
            "openSUSE Leap 16.0:emacs-el-0:30.2-160000.3.1.noarch",
            "openSUSE Leap 16.0:emacs-eln-0:30.2-160000.3.1.aarch64",
            "openSUSE Leap 16.0:emacs-eln-0:30.2-160000.3.1.ppc64le",
            "openSUSE Leap 16.0:emacs-eln-0:30.2-160000.3.1.s390x",
            "openSUSE Leap 16.0:emacs-eln-0:30.2-160000.3.1.x86_64",
            "openSUSE Leap 16.0:emacs-games-0:30.2-160000.3.1.aarch64",
            "openSUSE Leap 16.0:emacs-games-0:30.2-160000.3.1.ppc64le",
            "openSUSE Leap 16.0:emacs-games-0:30.2-160000.3.1.s390x",
            "openSUSE Leap 16.0:emacs-games-0:30.2-160000.3.1.x86_64",
            "openSUSE Leap 16.0:emacs-info-0:30.2-160000.3.1.noarch",
            "openSUSE Leap 16.0:emacs-nox-0:30.2-160000.3.1.aarch64",
            "openSUSE Leap 16.0:emacs-nox-0:30.2-160000.3.1.ppc64le",
            "openSUSE Leap 16.0:emacs-nox-0:30.2-160000.3.1.s390x",
            "openSUSE Leap 16.0:emacs-nox-0:30.2-160000.3.1.x86_64",
            "openSUSE Leap 16.0:emacs-x11-0:30.2-160000.3.1.aarch64",
            "openSUSE Leap 16.0:emacs-x11-0:30.2-160000.3.1.ppc64le",
            "openSUSE Leap 16.0:emacs-x11-0:30.2-160000.3.1.s390x",
            "openSUSE Leap 16.0:emacs-x11-0:30.2-160000.3.1.x86_64",
            "openSUSE Leap 16.0:etags-0:30.2-160000.3.1.aarch64",
            "openSUSE Leap 16.0:etags-0:30.2-160000.3.1.ppc64le",
            "openSUSE Leap 16.0:etags-0:30.2-160000.3.1.s390x",
            "openSUSE Leap 16.0:etags-0:30.2-160000.3.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2026-08-31T11:49:39Z",
          "details": "important"
        }
      ],
      "title": "CVE-2026-79992"
    }
  ]
}

CVE-2026-77219 (GCVE-0-2026-77219)

Vulnerability from cvelistv5 – Published: 2026-08-21 20:20 – Updated: 2026-08-21 21:42 X_Open Source

Title

GNU Emacs < 31.0.91 Heap Over-Read via PBM/PPM/PGM Image Loader

Summary

GNU Emacs before 31.0.91 contains an integer overflow in the PBM/PPM/PGM image loader that allows an attacker to leak heap memory contents by supplying a crafted image with large dimensions and an elevated max color index. The image loader multiplies image dimensions and channel count using signed integer arithmetic; for sufficiently large values, the result wraps to a negative number, bypassing the bounds check and causing the pixel reader to access heap memory past the end of the allocated buffer. The over-read contents are interpreted as pixel color values and rendered on screen.

Severity

6.9 (Medium)


                        
                          CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:N/VA:H/SC:N/SI:N/SA:N

7.1 (High)


                        
                          CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:H

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-08-21 21:32 UTC

CWE

CWE-190 - Integer Overflow or Wraparound
CWE-125 - Out-of-bounds Read

Assigner

VulnCheck mitre root

References

4 references

URL	Tags
https://debbugs.gnu.org/cgi/bugreport.cgi?bug=81344	issue-tracking
https://github.com/emacs-mirror/emacs/releases/ta…	release-notes
https://github.com/emacs-mirror/emacs/commit/b07e…	patch
https://www.vulncheck.com/advisories/gnu-emacs-he…	third-party-advisory

Impacted products

1 product

Vendor	Product	Version
GNU	Emacs	Affected: 0 , < 31.0.91 (semver)

Date Public

2026-07-01 00:00

Credits

Tristan Madani

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-77219",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-08-21T21:32:45.496424Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-08-21T21:42:58.824Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "affected",
          "packageURL": "pkg:github/emacs-mirror/emacs",
          "product": "Emacs",
          "repo": "https://github.com/emacs-mirror/emacs",
          "vendor": "GNU",
          "versions": [
            {
              "lessThan": "31.0.91",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Tristan Madani"
        }
      ],
      "datePublic": "2026-07-01T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "GNU Emacs before 31.0.91 contains an integer overflow in the PBM/PPM/PGM image loader that allows an attacker to leak heap memory contents by supplying a crafted image with large dimensions and an elevated max color index. The image loader multiplies image dimensions and channel count using signed integer arithmetic; for sufficiently large values, the result wraps to a negative number, bypassing the bounds check and causing the pixel reader to access heap memory past the end of the allocated buffer. The over-read contents are interpreted as pixel color values and rendered on screen."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "Automatable": "NOT_DEFINED",
            "Recovery": "NOT_DEFINED",
            "Safety": "NOT_DEFINED",
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "LOCAL",
            "baseScore": 6.9,
            "baseSeverity": "MEDIUM",
            "exploitMaturity": "NOT_DEFINED",
            "privilegesRequired": "NONE",
            "providerUrgency": "NOT_DEFINED",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "PASSIVE",
            "valueDensity": "NOT_DEFINED",
            "vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:N/VA:H/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "HIGH",
            "vulnConfidentialityImpact": "HIGH",
            "vulnIntegrityImpact": "NONE",
            "vulnerabilityResponseEffort": "NOT_DEFINED"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        },
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "HIGH",
            "baseScore": 7.1,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:H",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-190",
              "description": "Integer Overflow or Wraparound",
              "lang": "en",
              "type": "CWE"
            },
            {
              "cweId": "CWE-125",
              "description": "Out-of-bounds Read",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-21T20:20:45.314Z",
        "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
        "shortName": "VulnCheck"
      },
      "references": [
        {
          "name": "Bug Report",
          "tags": [
            "issue-tracking"
          ],
          "url": "https://debbugs.gnu.org/cgi/bugreport.cgi?bug=81344"
        },
        {
          "name": "Release Tag",
          "tags": [
            "release-notes"
          ],
          "url": "https://github.com/emacs-mirror/emacs/releases/tag/emacs-31.0.91"
        },
        {
          "name": "Patch Commit",
          "tags": [
            "patch"
          ],
          "url": "https://github.com/emacs-mirror/emacs/commit/b07e634e4cf45162ae0178e32092b040587f2c6c"
        },
        {
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://www.vulncheck.com/advisories/gnu-emacs-heap-over-read-via-pbm-ppm-pgm-image-loader"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "tags": [
        "x_open-source"
      ],
      "title": "GNU Emacs \u003c 31.0.91 Heap Over-Read via PBM/PPM/PGM Image Loader",
      "x_generator": {
        "engine": "vulncheck"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
    "assignerShortName": "VulnCheck",
    "cveId": "CVE-2026-77219",
    "datePublished": "2026-08-21T20:20:45.314Z",
    "dateReserved": "2026-08-20T18:25:46.943Z",
    "dateUpdated": "2026-08-21T21:42:58.824Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-79992 (GCVE-0-2026-79992)

Vulnerability from cvelistv5 – Published: 2026-08-25 17:16 – Updated: 2026-08-26 17:56

Title

Emacs: local shell command injection through the user field in emacs tramp

Summary

A flaw was found in Emacs TRAMP. A local attacker could exploit this vulnerability by processing maliciously crafted filenames. This occurs because TRAMP concatenates login arguments without proper sanitization, which are then passed to a local shell. Successful exploitation could lead to arbitrary code execution.

Severity

7.8 (High)


                        
                          CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

SSVC

Exploitation: none Automatable: no Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-08-25 17:32 UTC

CWE

CWE-78 - Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')

Assigner

redhat redhat root

References

3 references

URL	Tags
https://access.redhat.com/security/cve/CVE-2026-79992	vdb-entryx_refsource_REDHAT
https://bugzilla.redhat.com/show_bug.cgi?id=2523665	issue-trackingx_refsource_REDHAT
http://www.openwall.com/lists/oss-security/2026/0…

Impacted products

5 products

Vendor	Product	Version
Red Hat	Red Hat Enterprise Linux 10	cpe:/o:redhat:enterprise_linux:10
Red Hat	Red Hat Enterprise Linux 6	cpe:/o:redhat:enterprise_linux:6
Red Hat	Red Hat Enterprise Linux 7	cpe:/o:redhat:enterprise_linux:7
Red Hat	Red Hat Enterprise Linux 8	cpe:/o:redhat:enterprise_linux:8
Red Hat	Red Hat Enterprise Linux 9	cpe:/o:redhat:enterprise_linux:9

Date Public

2026-08-21 00:00

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-79992",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-08-25T17:32:22.093371Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-08-25T17:43:23.591Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "providerMetadata": {
          "dateUpdated": "2026-08-26T17:56:00.585Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "url": "http://www.openwall.com/lists/oss-security/2026/08/26/15"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/o:redhat:enterprise_linux:10"
          ],
          "defaultStatus": "affected",
          "packageName": "emacs",
          "product": "Red Hat Enterprise Linux 10",
          "vendor": "Red Hat"
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/o:redhat:enterprise_linux:6"
          ],
          "defaultStatus": "affected",
          "packageName": "emacs",
          "product": "Red Hat Enterprise Linux 6",
          "vendor": "Red Hat"
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/o:redhat:enterprise_linux:7"
          ],
          "defaultStatus": "affected",
          "packageName": "emacs",
          "product": "Red Hat Enterprise Linux 7",
          "vendor": "Red Hat"
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/o:redhat:enterprise_linux:8"
          ],
          "defaultStatus": "affected",
          "packageName": "emacs",
          "product": "Red Hat Enterprise Linux 8",
          "vendor": "Red Hat"
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/o:redhat:enterprise_linux:9"
          ],
          "defaultStatus": "affected",
          "packageName": "emacs",
          "product": "Red Hat Enterprise Linux 9",
          "vendor": "Red Hat"
        }
      ],
      "datePublic": "2026-08-21T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "A flaw was found in Emacs TRAMP. A local attacker could exploit this vulnerability by processing maliciously crafted filenames. This occurs because TRAMP concatenates login arguments without proper sanitization, which are then passed to a local shell. Successful exploitation could lead to arbitrary code execution."
        }
      ],
      "metrics": [
        {
          "other": {
            "content": {
              "namespace": "https://access.redhat.com/security/updates/classification/",
              "value": "Important"
            },
            "type": "Red Hat severity rating"
          }
        },
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "HIGH",
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "format": "CVSS"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-78",
              "description": "Improper Neutralization of Special Elements used in an OS Command (\u0027OS Command Injection\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-25T17:44:28.008Z",
        "orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
        "shortName": "redhat"
      },
      "references": [
        {
          "tags": [
            "vdb-entry",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/security/cve/CVE-2026-79992"
        },
        {
          "name": "RHBZ#2523665",
          "tags": [
            "issue-tracking",
            "x_refsource_REDHAT"
          ],
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2523665"
        }
      ],
      "timeline": [
        {
          "lang": "en",
          "time": "2026-08-25T16:40:51.291Z",
          "value": "Reported to Red Hat."
        },
        {
          "lang": "en",
          "time": "2026-08-21T00:00:00.000Z",
          "value": "Made public."
        }
      ],
      "title": "Emacs: local shell command injection through the user field in emacs tramp",
      "workarounds": [
        {
          "lang": "en",
          "value": "Users of Emacs TRAMP should avoid processing untrusted filenames or interacting with remote systems that may contain maliciously crafted file names. This operational control reduces the risk of local shell command injection."
        }
      ],
      "x_generator": {
        "engine": "cvelib 1.8.0"
      },
      "x_redhatCweChain": "CWE-78: Improper Neutralization of Special Elements used in an OS Command (\u0027OS Command Injection\u0027)"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
    "assignerShortName": "redhat",
    "cveId": "CVE-2026-79992",
    "datePublished": "2026-08-25T17:16:28.309Z",
    "dateReserved": "2026-08-25T16:39:44.534Z",
    "dateUpdated": "2026-08-26T17:56:00.585Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.

Action not permitted

OPENSUSE-SU-2026:21711-1

CVE-2026-77219 (GCVE-0-2026-77219)

CVE-2026-79992 (GCVE-0-2026-79992)

Tags

Sightings

Nomenclature

Related by attack behaviour