Emacs arbitrary code execution on file open hits 28.1 and later

Eshel Yaron has reported an arbitrary code execution flaw in GNU Emacs that is exploitable simply by opening a crafted file. The bug affects Emacs 28.1 and all later releases.

Anyone who opens an untrusted file in a vulnerable build can therefore trigger attacker-controlled code with no further steps. Yaron is the same researcher behind CVE-2024-53920, an earlier Emacs issue in the same class.

Upstream shipped a workaround on the Emacs 31 line and a broader rework on the development trunk. Gentoo has backported the fix down to Emacs 28.2, Sam James of Gentoo said when he flagged the issue on the oss-security list.