Emacs arbitrary code execution flaw

Emacs upstream maintainer Sean Whitton announced that the original fix for the arbitrary code execution flaw CVE-2024-53920 was incomplete, after Bas Alberts found that viewing or editing untrusted files in modes other than Emacs's Lisp mode can also trigger arbitrary code execution. The flaw affects all Emacs versions affected by CVE-2024-53920, meaning Emacs 24 and newer and possibly older versions. A minimal fix is queued for release with Emacs 31.2, and the maintainers do not expect to backport it to older Emacs releases.

Sean Whitton has announced https://lwn.net/ml/all/87tsnskt3e.fsf%40athena.silentflame.com/ that the original fix for an arbitrary code execution flaw in Emacs CVE-2024-53920 https://nvd.nist.gov/vuln/detail/cve-2024-53920 was incomplete. Bas Alberts discovered that viewing or editing untrusted files in modes other than Emacs's Lisp mode can also result in arbitrary code execution. This problem affects all Emacs versions affected by CVE-2024-53920. This means Emacs 24 and newer, and possibly also older versions. A minimal fix, attached, is queued up for release with Emacs 31.2. We the Emacs upstream maintainers don't expect to backport the fix to older Emacs releases ourselves. LWN covered https://lwn.net/Articles/1002046/ the original vulnerability in December 2024.