# Emacs arbitrary code execution flaw

DevFeed: [Emacs arbitrary code execution flaw](<https://devfeed.tech/articles/emacs-arbitrary-code-execution-flaw-21541.md>)

Original publisher: [Read original article](<https://lwn.net/Articles/1094224/>)

Author: jzb

Published: 2026-09-14T15:20:00Z

Content type: news

Language: en

Sources: [LWN.net](<https://devfeed.tech/sources/lwn-net.md>)

Topics: [Lisp](<https://devfeed.tech/topics/lisp.md>), [vulnerability](<https://devfeed.tech/topics/vulnerability.md>), [Maintainers](<https://devfeed.tech/topics/maintainers.md>)

Tags: [cve](<https://devfeed.tech/tags/cve.md>), [emacs](<https://devfeed.tech/tags/emacs.md>), [maintainers](<https://devfeed.tech/tags/maintainers.md>), [release](<https://devfeed.tech/tags/release.md>), [vulnerability](<https://devfeed.tech/tags/vulnerability.md>)

## AI overview

An incomplete fix for the Emacs arbitrary code execution flaw CVE-2024-53920 has been identified. Viewing or editing untrusted files in modes other than Emacs's Lisp mode can also trigger arbitrary code execution. The issue affects Emacs 24 and newer, with a minimal fix queued for Emacs 31.2; upstream maintainers do not expect to backport it to older releases.

## Source excerpt

Sean Whitton has announced that the original fix for an arbitrary code execution flaw in Emacs (CVE-2024-53920) was incomplete. Bas Alberts discovered that viewing or editing untrusted files in modes other than Emacs's Lisp mode can also result in arbitrary code execution. This problem affects all Emacs versions affected by CVE-2024-53920. This means Emacs 24 and newer, and possibly also older versions. A minimal fix, attached, is queued up for release with Emacs 31.2. We (the Emacs upstream maintainers) don't expect to backport the fix to older Emacs releases ourselves. LWN covered the original vulnerability in December 2024.