#VU87809 Insufficient verification of data authenticity in Emacs - CVE-2024-30204

Vulnerability identifier: #VU87809

Vulnerability risk: High

CVSSv4.0: CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Amber

CVE-ID: CVE-2024-30204

CWE-ID: CWE-345

Exploitation vector: Remote access

Exploit availability: No public exploit available

Vulnerable software:
Emacs

Software vendor:
GNU

The vulnerability allows a remote attacker to compromise the affected system.

The vulnerability exists due to LaTeX preview is enabled by default for e-mail attachments. A remote attacker can trick the victim to open a specially crafted file and execute arbitrary code on the system.

Install updates from vendor's website.

• https://git.savannah.gnu.org/cgit/emacs.git/tree/etc/NEWS?h=emacs-29
• https://git.savannah.gnu.org/cgit/emacs.git/commit/?h=emacs-29&id=6f9ea396f49cbe38c2173e0a72ba6af3e03b271c