GNU Emacs before 31.0.91 contains an integer overflow in the PBM/PPM/PGM image loader that allows an attacker to leak heap memory contents by supplying a crafted image with large dimensions and an elevated max color index. The image loader multiplies image dimensions and channel count using signed integer arithmetic; for sufficiently large values, the result wraps to a negative number, bypassing the bounds check and causing the pixel reader to access heap memory past the end of the allocated buffer. The over-read contents are interpreted as pixel color values and rendered on screen.

The remote openSUSE 16 host has packages installed that are affected by multiple vulnerabilities as referenced in the openSUSE-SU-2026:21711-1 advisory.

    Security issues fixed:

    - Arbitrary code execution when opening a specially crafted file (bsc#1275941).
    - CVE-2026-77219: integer overflow in the PBM/PPM/PGM image loader leads to heap memory content leaks when     a crafted       image with large dimensions and an elevated max color index is processed (bsc#1276264).
    - CVE-2026-79992: improper argument sanitization in TRAMP leads to arbitrary code execution via crafted     filenames       (bsc#1275927).

    Other updates and bugfixes:

    - Fix memory leak in wayland port (bsc#1271643).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 43 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2026-8894da1406 advisory.

    Fix CVE-2026-77219: Integer overflow in PBM/PPM/PGM image loader.

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Fedora 44 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2026-60eff202e7 advisory.

    Fix CVE-2026-77219: Integer overflow in PBM/PPM/PGM image loader.

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - GNU Emacs before 31.0.91 contains an integer overflow in the PBM/PPM/PGM image loader that allows an     attacker to leak heap memory contents by supplying a crafted image with large dimensions and an elevated     max color index. The image loader multiplies image dimensions and channel count using signed integer     arithmetic; for sufficiently large values, the result wraps to a negative number, bypassing the bounds     check and causing the pixel reader to access heap memory past the end of the allocated buffer. The over-     read contents are interpreted as pixel color values and rendered on screen. (CVE-2026-77219)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Type	Severity
342572	openSUSE 16: emacs / emacs-el / emacs-eln / emacs-games / emacs-info / emacs-nox / etc (openSUSE-SU-2026:21711-1)	Nessus	SuSE Local Security Checks	Local	medium
341811	Fedora 43 : emacs (2026-8894da1406)	Nessus	Fedora Local Security Checks	Local	medium
340981	Fedora 44 : emacs (2026-60eff202e7)	Nessus	Fedora Local Security Checks	Local	medium
338845	Linux Distros Unpatched Vulnerability : CVE-2026-77219	Nessus	Misc.	Local	medium

Detections

Analytics

CVE-2026-77219

medium

Tenable Plugins

medium

medium

medium

medium