# CVE-2026-79992: Emacs: emacs: command injection via crafted filenames in tramp

Status: published. Published: 2026-08-25. Updated: 2026-11-02.

A flaw was found in Emacs TRAMP. A local attacker could exploit this vulnerability by processing maliciously crafted filenames. This occurs because TRAMP concatenates login arguments without proper sanitization, which are then passed to a local shell. Successful exploitation could lead to arbitrary code execution.

## Remediation

- workaround: Users of Emacs TRAMP should avoid processing untrusted filenames or interacting with remote systems that may contain maliciously crafted file names. This operational control reduces the risk of local shell command injection. (source: CNA: redhat)

## Affected products and versions

- Red Hat / Red Hat Enterprise Linux 10 (emacs): ≥ 1:29.4-14.el10_2.3; < * (unaffected, rpm). Source: CNA: redhat
- Red Hat / Red Hat Enterprise Linux 8 (emacs): ≥ 1:26.1-15.el8_10.2; < * (unaffected, rpm). Source: CNA: redhat
- Red Hat / Red Hat Enterprise Linux 9 (emacs): ≥ 1:27.2-18.el9_8.2; < * (unaffected, rpm). Source: CNA: redhat
- Red Hat / Red Hat Enterprise Linux 6 (emacs): Version range not reported. Source: CNA: redhat
- Red Hat / Red Hat Enterprise Linux 7 (emacs): Version range not reported. Source: CNA: redhat

## Severity and prioritization

- CVSS 3.1: 7.8 (high); CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H; source: CNA: redhat

- CISA KEV: No listing in collected sources

- EPSS: 0.22% as of 2026-11-01; percentile 12.48%

- SSVC: exploitation none; automatable no; technical impact total; source ADP: CISA-ADP

- Weaknesses: CWE-78

## Exploit evidence

No exploit evidence in collected sources. This is not proof of no exploitation.

## References

- https://access.redhat.com/errata/RHSA-2026:80506 (CNA: redhat; vendor-advisory, x_refsource_REDHAT)

- https://access.redhat.com/errata/RHSA-2026:80507 (CNA: redhat; vendor-advisory, x_refsource_REDHAT)

- https://access.redhat.com/errata/RHSA-2026:84591 (CNA: redhat; vendor-advisory, x_refsource_REDHAT)

- https://access.redhat.com/security/cve/CVE-2026-79992 (CNA: redhat; vdb-entry, x_refsource_REDHAT)

- https://bugzilla.redhat.com/show_bug.cgi?id=2523665 (CNA: redhat; issue-tracking, x_refsource_REDHAT)

- http://www.openwall.com/lists/oss-security/2026/08/26/15 (ADP: CVE)

- http://www.openwall.com/lists/oss-security/2026/10/11/1 (ADP: CVE)

- http://www.openwall.com/lists/oss-security/2026/10/14/4 (ADP: CVE)

## Provenance

- CNA: redhat: https://www.cve.org/CVERecord?id=CVE-2026-79992; retrieved 2026-11-02; source updated 2026-11-02

- FIRST EPSS: https://api.first.org/data/v1/epss?cve=CVE-2026-79992; retrieved 2026-11-02; source updated Not reported

Revision: cccfba5915e2a656bfbf9a5ebc35c677f785b8b4d9056d32f6c416a5ad885669

Canonical: https://y2.dev/cve/CVE-2026-79992