The AlmaLinux 9.2 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare ALMALINUX9.2:CLSA-2026:1792080478 advisory.

  - GNU Emacs before 31.2 (and TRAMP through 2.8.2) allows OS command injection via a filename because tramp-     user-regexp has an incomplete list of disallowed inputs. NOTE: this issue exists because of an incomplete     fix for CVE-2026-79992. (CVE-2026-108976)

  - GNU Emacs before 31.0.91 contains an integer overflow in the PBM/PPM/PGM image loader that allows an     attacker to leak heap memory contents by supplying a crafted image with large dimensions and an elevated     max color index. The image loader multiplies image dimensions and channel count using signed integer     arithmetic; for sufficiently large values, the result wraps to a negative number, bypassing the bounds     check and causing the pixel reader to access heap memory past the end of the allocated buffer. The over-     read contents are interpreted as pixel color values and rendered on screen. (CVE-2026-77219)

  - A flaw was found in Emacs TRAMP. A local attacker could exploit this vulnerability by processing     maliciously crafted filenames. This occurs because TRAMP concatenates login arguments without proper     sanitization, which are then passed to a local shell. Successful exploitation could lead to arbitrary code     execution. (CVE-2026-79992)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Detections

Analytics

AlmaLinux 9.2 [TuxCare] Security Update: emacs / emacs-common / emacs-devel / emacs-filesystem / emacs-lucid / etc Multiple Vulnerabilities (ALMALINUX9.2:CLSA-2026:1792080478)

medium Nessus Plugin ID 366236

Version 1.2

Version 1.1

Version 1.2 Oct 16, 2026, 3:19 PM CVSSv2 score source (changed from "CVE-2026-79992" to "CVE-2026-108976") CVSSv3 score source (set to "CVE-2026-79992") Plugin Feed: 202610161519
Version 1.1 Oct 16, 2026, 2:12 AM New Plugin Feed: 202610160212