ALAS2023-2026-2147

Amazon Linux 2023 Security Advisory: ALAS2023-2026-2147
Advisory Released Date: 2026-09-14
Advisory Updated Date: 2026-09-14
Severity: Important
Issue Overview:

GNU Emacs before 31.0.91 contains an integer overflow in the PBM/PPM/PGM image loader that allows an attacker to leak heap memory contents by supplying a crafted image with large dimensions and an elevated max color index. The image loader multiplies image dimensions and channel count using signed integer arithmetic; for sufficiently large values, the result wraps to a negative number, bypassing the bounds check and causing the pixel reader to access heap memory past the end of the allocated buffer. The over-read contents are interpreted as pixel color values and rendered on screen. (CVE-2026-77219)

A flaw was found in Emacs TRAMP. A local attacker could exploit this vulnerability by processing maliciously crafted filenames. This occurs because TRAMP concatenates login arguments without proper sanitization, which are then passed to a local shell. Successful exploitation could lead to arbitrary code execution. (CVE-2026-79992)


Affected Packages:

emacs


Issue Correction:
Run dnf update emacs --releasever 2023.12.20260914 or dnf update --advisory ALAS2023-2026-2147 --releasever 2023.12.20260914 to update your system.
More information on how to update your system can be found on this page: Amazon Linux 2023 documentation

New Packages:
aarch64:
    emacs-debugsource-28.2-3.amzn2023.0.11.aarch64
    emacs-common-debuginfo-28.2-3.amzn2023.0.11.aarch64
    emacs-devel-28.2-3.amzn2023.0.11.aarch64
    emacs-debuginfo-28.2-3.amzn2023.0.11.aarch64
    emacs-nox-debuginfo-28.2-3.amzn2023.0.11.aarch64
    emacs-lucid-debuginfo-28.2-3.amzn2023.0.11.aarch64
    emacs-lucid-28.2-3.amzn2023.0.11.aarch64
    emacs-nox-28.2-3.amzn2023.0.11.aarch64
    emacs-28.2-3.amzn2023.0.11.aarch64
    emacs-common-28.2-3.amzn2023.0.11.aarch64

noarch:
    emacs-terminal-28.2-3.amzn2023.0.11.noarch
    emacs-filesystem-28.2-3.amzn2023.0.11.noarch

src:
    emacs-28.2-3.amzn2023.0.11.src

x86_64:
    emacs-debugsource-28.2-3.amzn2023.0.11.x86_64
    emacs-lucid-debuginfo-28.2-3.amzn2023.0.11.x86_64
    emacs-common-debuginfo-28.2-3.amzn2023.0.11.x86_64
    emacs-devel-28.2-3.amzn2023.0.11.x86_64
    emacs-debuginfo-28.2-3.amzn2023.0.11.x86_64
    emacs-nox-debuginfo-28.2-3.amzn2023.0.11.x86_64
    emacs-nox-28.2-3.amzn2023.0.11.x86_64
    emacs-lucid-28.2-3.amzn2023.0.11.x86_64
    emacs-28.2-3.amzn2023.0.11.x86_64
    emacs-common-28.2-3.amzn2023.0.11.x86_64

Additional References

Release Notes:  Amazon Linux 2023 Release Notes

Red Hat: CVE-2026-77219, CVE-2026-79992

Mitre: CVE-2026-77219, CVE-2026-79992