Cyber ·
Incomplete fix for CVE-2026-79992 in Emacs
Researchers found that the fix for CVE-2026-79992 in Emacs was incomplete. A patch from the TRAMP maintainer will be included in Emacs 31.2, which has no announced release date.
On 11 October 2026, Sean Whitton posted to the oss-sec list an advisory about CVE-2026-79992, a flaw in Emacs. Wonyoung Jung, of 78ResearchLab, using the PatchHawk tool, found that the original fix did not cover some additional problematic characters in user names. The tramp-user-regexp function let those characters pass, which kept exploitation possible. The attached patch, written by Michael Albinus, maintainer of TRAMP, resolves the problem and will be included in Emacs 31.2. The text states that this version will not be released soon. This summary was machine-translated from the feed content. To verify, consult the 2026 fourth-quarter oss-sec list archive, message 132, and confirm the patch and version before applying any change.
Original source: Correção incompleta para a CVE-2026-79992 do Emacs