diff options
| author | Joseph Mingrone <jrm@FreeBSD.org> | 2026-07-06 04:15:29 +0000 |
|---|---|---|
| committer | Joseph Mingrone <jrm@FreeBSD.org> | 2026-07-06 04:27:51 +0000 |
| commit | 28960ffb038844f0a1498e39a4f3060ba0e08381 (patch) | |
| tree | 05c018c052ca42d6a4f8aa7dd38aa88cc120d2c4 | |
| parent | 915d199e510d37e924567bbe2740fbb8ebd0a313 (diff) | |
security/vuxml: Document Emacs vulnerability
PR: 296546
Security: CVE-2026-6861
Sponsored by: The FreeBSD Foundation
| -rw-r--r-- | security/vuxml/vuln/2026.xml | 43 |
1 files changed, 43 insertions, 0 deletions
diff --git a/security/vuxml/vuln/2026.xml b/security/vuxml/vuln/2026.xml index 15994d1f2c08..574eab756a85 100644 --- a/security/vuxml/vuln/2026.xml +++ b/security/vuxml/vuln/2026.xml @@ -1,3 +1,46 @@ + <vuln vid="c7be43b0-78f0-11f1-8898-1c697a616631"> + <topic>Emacs -- Heap out-of-bounds write when rendering SVG images</topic> + <affects> + <package> + <name>emacs</name> + <name>emacs-canna</name> + <name>emacs-nox</name> + <name>emacs-wayland</name> + <range><ge>28.1,3</ge><lt>30.2_4,3</lt></range> + </package> + <package> + <name>emacs-devel</name> + <name>emacs-devel-nox</name> + <range><lt>31.0.50.20250201,3</lt></range> + </package> + </affects> + <description> + <body xmlns="http://www.w3.org/1999/xhtml"> + <h1>Problem Description</h1> + <p>When GNU Emacs renders an SVG image whose image spec includes a + :css property, an off-by-one error in svg_load_image() writes a NUL + byte one position past the end of a heap allocation. The copied + string is also left without NUL termination within its allocation, + causing a subsequent out-of-bounds read.</p> + <h1>Impact</h1> + <p>A single NUL byte heap overflow is a well-understood exploitation + primitive ("poison NUL byte") that can corrupt heap metadata and + potentially be escalated to arbitrary code execution. The overflow + can be triggered by Lisp code that displays an SVG image with a + crafted :css property.</p> + </body> + </description> + <references> + <cvename>CVE-2026-6861</cvename> + <url>https://debbugs.gnu.org/cgi/bugreport.cgi?bug=80851</url> + <url>https://nvd.nist.gov/vuln/detail/CVE-2026-6861</url> + </references> + <dates> + <discovery>2026-04-17</discovery> + <entry>2026-07-06</entry> + </dates> + </vuln> + <vuln vid="d7939352-788b-11f1-b72c-8447094a420f"> <topic>Weechat -- Memory leak in relay-API</topic> <affects> |