# Emacs arbitrary code execution flaw

> Source: <https://lwn.net/Articles/1094224/>
> Published: 2026-09-14 15:20:00+00:00

Sean Whitton has [announced](https://lwn.net/ml/all/87tsnskt3e.fsf%40athena.silentflame.com/)
that the original fix for an arbitrary code execution flaw in Emacs ([CVE-2024-53920](https://nvd.nist.gov/vuln/detail/cve-2024-53920)) was
incomplete. Bas Alberts discovered that viewing or editing untrusted files in
modes other than Emacs's Lisp mode can also result in arbitrary code
execution.

This problem affects all Emacs versions affected by CVE-2024-53920. This means Emacs 24 and newer, and possibly also older versions.

A minimal fix, attached, is queued up for release with Emacs 31.2. We (the Emacs upstream maintainers) don't expect to backport the fix to older Emacs releases ourselves.

LWN [covered](https://lwn.net/Articles/1002046/) the original
vulnerability in December 2024.