7.8

CVE-2024-53920: gnu emacs Code Injection

CVSS: 7.8v3.1HighModified
AliasesMGASA-2024-0397SUSE-SU-2024:4392-1SUSE-SU-2025:0798-1
Published 27-11-2024Last modified 21-09-2026
Open JSON

Vulnerability summary

CVE-2024-53920 is a high (CVSS 7.8) Code Injection vulnerability in gnu emacs. EPSS estimates a 0.60% chance of exploitation in the next 30 days, higher than 47.7% of scored vulnerabilities.

Overall risk
31/100
0100
Medium · default modelHow is this calculated?
CVSS score
7.8/10
010
High · v3.1 (CVE.org)
EPSS score
0.60%
0%100%
Low · -0.04 pp in 30 days
KEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits0No public exploits recorded

Advisory lineage

Upstream 0 · Downstream 3 · Related 1
DLA-4069-1DSA-5871-1USN-8011-1

Timeline

  1. 27-11-2024
    PublishedVulnerability first disclosed.
  2. 21-09-2026
    Last modifiedVulnerability information updated.

Description

In elisp-mode.el in GNU Emacs before 30.1, a user who chooses to invoke elisp-completion-at-point (for code completion) on untrusted Emacs Lisp source code can trigger unsafe Lisp macro expansion that allows attackers to execute arbitrary code. (This unsafe expansion also occurs if a user chooses to enable on-the-fly diagnosis that byte compiles untrusted Emacs Lisp source code.)

CVSS metrics

5 scores · 5 sources · 1 version

EPSS trend

Probability

0.60%

Chance of exploitation in the next 30 days

Percentile

48%

Versus all other CVEs

30-day change

-0.04 pp

From 0.64% on 20-09-2026

20-09-202620-10-2026
EPSS score
0.60%

Known exploited

Compare KEV catalogs

Not in any of the 3 tracked catalogs.

Public exploits

0 found

No public exploits indexed.

Weaknesses

CWE · root cause

Affected systems

Suse14 products
  • emacs&distro=SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS< 27.2-150400.3.20.2 | < 27.2-150400.3.26.1
  • emacs&distro=SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS< 27.2-150400.3.20.2 | < 27.2-150400.3.26.1
  • emacs&distro=SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS< 27.2-150400.3.26.1
  • emacs&distro=SUSE Linux Enterprise High Performance Computing 15 SP5-LTSS< 27.2-150400.3.26.1
  • emacs&distro=SUSE Linux Enterprise Module for Basesystem 15 SP5< 27.2-150400.3.20.2
Redhat11 products
  • emacs< 1:26.1-15.el8_10 | < 1:27.2-11.el9_5.2 | < 1:27.2-10.el9_4.2 | < 1:27.2-8.el9_2.3 | < 1:27.2-14.el9_6.2
  • emacs-common< 1:26.1-15.el8_10 | < 1:27.2-11.el9_5.2 | < 1:27.2-10.el9_4.2 | < 1:27.2-8.el9_2.3 | < 1:27.2-14.el9_6.2
  • emacs-common-debuginfo< 1:26.1-15.el8_10 | < 1:27.2-11.el9_5.2 | < 1:27.2-10.el9_4.2 | < 1:27.2-8.el9_2.3 | < 1:27.2-14.el9_6.2
  • emacs-debuginfo< 1:26.1-15.el8_10 | < 1:27.2-11.el9_5.2 | < 1:27.2-10.el9_4.2 | < 1:27.2-8.el9_2.3 | < 1:27.2-14.el9_6.2
  • emacs-debugsource< 1:26.1-15.el8_10 | < 1:27.2-11.el9_5.2 | < 1:27.2-10.el9_4.2 | < 1:27.2-8.el9_2.3 | < 1:27.2-14.el9_6.2
Ubuntu5 products
  • emacs< 1:26.3+1-1ubuntu2+esm2 | < 1:27.1+1-3ubuntu5.2+esm1 | < 1:29.3+1-1ubuntu2+esm3
  • emacs24All versions (No fix recorded)
  • emacs25All versions (No fix recorded)
  • xemacs21All versions (No fix recorded)
  • xemacs21-packagesAll versions (No fix recorded)
Opensuse3 products
  • emacs&distro=openSUSE Leap 15.5< 27.2-150400.3.20.2
  • emacs&distro=openSUSE Leap 15.6< 27.2-150400.3.20.2 | < 27.2-150400.3.26.1
  • emacs&distro=openSUSE Tumbleweed< 29.4-11.1
Debian1 product
  • emacs< 1:28.2+1-15+deb12u4 | < 1:30.1+1-1
Gnu1 product
Mageia1 product
  • emacs< 29.4-1.2.mga9

7 vendors · 36 products

References

38 links
Show all 38 references