Vulnerability · Published Aug 21, 2026 · Assigned by VulnCheck
CVE-2026-77219GNU Emacs < 31.0.91 Heap Over-Read via PBM/PPM/PGM Image Loader
High 7.1
In plain English
A high-severity integer overflow in Emacs from GNU. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.1% (higher than 3% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
GNU Emacs before 31.0.91 contains an integer overflow in the PBM/PPM/PGM image loader that allows an attacker to leak heap memory contents by supplying a crafted image with large dimensions and an elevated max color index. The image loader multiplies image dimensions and channel count using signed integer arithmetic; for sufficiently large values, the result wraps to a negative number, bypassing the bounds check and causing the pixel reader to access heap memory past the end of the allocated buffer. The over-read contents are interpreted as pixel color values and rendered on screen.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| AlmaLinux:10 | emacs | 1:29.4-14.el10_2.3 | ALSA-2026:84591 |
| AlmaLinux:8 | emacs | 1:26.1-15.el8_10.2 | ALSA-2026:80506 |
| AlmaLinux:9 | emacs | 1:27.2-18.el9_8.2 | ALSA-2026:80507 |
| AlmaLinux:10 | emacs-common | 1:29.4-14.el10_2.3 | ALSA-2026:84591 |
| AlmaLinux:8 | emacs-common | 1:26.1-15.el8_10.2 | ALSA-2026:80506 |
| AlmaLinux:9 | emacs-common | 1:27.2-18.el9_8.2 | ALSA-2026:80507 |
| AlmaLinux:10 | emacs-filesystem | 1:29.4-14.el10_2.3 | ALSA-2026:84591 |
| AlmaLinux:8 | emacs-filesystem | 1:26.1-15.el8_10.2 | ALSA-2026:80506 |
| AlmaLinux:9 | emacs-filesystem | 1:27.2-18.el9_8.2 | ALSA-2026:80507 |
| AlmaLinux:10 | emacs-lucid | 1:29.4-14.el10_2.3 | ALSA-2026:84591 |
| AlmaLinux:8 | emacs-lucid | 1:26.1-15.el8_10.2 | ALSA-2026:80506 |
| AlmaLinux:9 | emacs-lucid | 1:27.2-18.el9_8.2 | ALSA-2026:80507 |
| AlmaLinux:8 | emacs-nox | 1:26.1-15.el8_10.2 | ALSA-2026:80506 |
| AlmaLinux:9 | emacs-nox | 1:27.2-18.el9_8.2 | ALSA-2026:80507 |
| AlmaLinux:10 | emacs-nw | 1:29.4-14.el10_2.3 | ALSA-2026:84591 |
| AlmaLinux:8 | emacs-terminal | 1:26.1-15.el8_10.2 | ALSA-2026:80506 |
| Debian:12 | emacs | no fix listed | DEBIAN-CVE-2026-77219 |
| Debian:13 | emacs | no fix listed | DEBIAN-CVE-2026-77219 |
| Debian:14 | emacs | no fix listed | DEBIAN-CVE-2026-77219 |
| Rocky Linux:10 | emacs | 1:29.4-14.el10_2.3 | RLSA-2026:84591 |
| Rocky Linux:8 | emacs | 1:26.1-15.el8_10.2 | RLSA-2026:80506 |
| Rocky Linux:9 | emacs | 1:27.2-18.el9_8.2 | RLSA-2026:80507 |
| Ubuntu:26.10 | emacs | no fix listed | UBUNTU-CVE-2026-77219 |
| Ubuntu:22.04:LTS | xemacs21 | no fix listed | UBUNTU-CVE-2026-77219 |
| Ubuntu:24.04:LTS | xemacs21 | no fix listed | UBUNTU-CVE-2026-77219 |
| Ubuntu:26.04:LTS | xemacs21 | no fix listed | UBUNTU-CVE-2026-77219 |
| Ubuntu:26.10 | xemacs21 | no fix listed | UBUNTU-CVE-2026-77219 |
| Ubuntu:22.04:LTS | xemacs21-packages | no fix listed | UBUNTU-CVE-2026-77219 |
| Ubuntu:24.04:LTS | xemacs21-packages | no fix listed | UBUNTU-CVE-2026-77219 |
| Ubuntu:26.04:LTS | xemacs21-packages | no fix listed | UBUNTU-CVE-2026-77219 |
| Ubuntu:26.10 | xemacs21-packages | no fix listed | UBUNTU-CVE-2026-77219 |
Affected products (as reported)
Weakness: CWE-190, CWE-125 · Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:H
References
- Bug Report issue-tracking
- Release Tag release-notes
- Patch Commit patch
- https://www.vulncheck.com/advisories/gnu-emacs-heap-over-read-via-pbm-ppm-pgm-image-loader third-party-advisory