Description

GNU Emacs before 31.0.91 contains an integer overflow in the PBM/PPM/PGM image loader that allows an attacker to leak heap memory contents by supplying a crafted image with large dimensions and an elevated max color index. The image loader multiplies image dimensions and channel count using signed integer arithmetic; for sufficiently large values, the result wraps to a negative number, bypassing the bounds check and causing the pixel reader to access heap memory past the end of the allocated buffer. The over-read contents are interpreted as pixel color values and rendered on screen.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.1",
  "pubDate": "2026-08-21T21:17:06.590Z",
  "pubdate": "2026-08-21T21:17:06.590Z",
  "executiveSummary": "GNU Emacs before 31.0.91 contains an integer overflow vulnerability within its PBM, PPM, and PGM image loader. This flaw enables an unauthenticated attacker to leak arbitrary heap memory contents by inducing a buffer over-read through a maliciously crafted image file.\nThe vulnerability arises from insecure signed integer arithmetic used during the calculation of image buffer allocations. When an attacker supplies an image with extremely large dimensions and an elevated maximum color index, the arithmetic operation wraps around to a negative value. This calculation bypasses critical bounds checks, leading the pixel reader to access heap memory locations situated beyond the allocated buffer boundaries.\nThe resulting impact is limited to information disclosure, where the leaked heap memory contents are interpreted as pixel color values and subsequently rendered directly on the screen to the user. Exploitation requires the victim to process a specially crafted image file within GNU Emacs.\nThe risk implication involves potential leakage of sensitive data residing on the heap, such as credentials, cryptographic keys, or internal application state, depending on adjacent heap memory contents at the time of rendering.",
  "technicalDetails": "The vulnerability resides in the PBM/PPM/PGM image loader component of GNU Emacs, affecting versions prior to 31.0.91. The root cause is an integer overflow flaw stemming from the use of signed integer arithmetic when calculating memory requirements for image processing.\nSpecifically, the vulnerable image loader multiplies the image dimensions (width and height) alongside the channel count using signed integer operations. When processing a crafted image file containing excessively large dimensions paired with an elevated max color index, the product exceeds the maximum limit of the signed integer type, causing it to wrap around and evaluate as a negative number.\nThis negative result successfully bypasses subsequent memory allocation bounds checks intended to validate buffer sizes. Consequently, the pixel reader allocates a buffer based on the wrapped size while attempting to read pixel data corresponding to the massive dimensions defined in the image header.\nThe exploitation method relies on supplying a malicious image file to the victim. The attack flow proceeds as follows: First, the attacker crafts a PBM, PPM, or PGM image with manipulated headers specifying extreme dimensions and an elevated max color index. Second, the victim opens or renders this crafted image within GNU Emacs. Third, the image loader performs the vulnerable multiplication, triggering the signed integer overflow and bypassing bounds validation. Fourth, the pixel reader accesses heap memory past the end of the undersized allocated buffer. Finally, the over-read contents are incorrectly interpreted as valid pixel color values and rendered on the user interface, allowing the attacker to visually exfiltrate heap data.\nThe vulnerability requires no authentication or special privileges to exploit, but it does require user interaction in the form of opening or rendering the malicious image file within the application."
}