This vulnerability is a memory corruption issue in GNU Emacs triggered by processing maliciously crafted SVG CSS data. It is classified as an off-by-one error, which can lead to memory corruption. The flaw allows a local user to cause a denial of service or potentially disclose information by convincing a victim to open a crafted SVG file. The CVSS 3.1 base score is 6.1, reflecting medium severity with local attack vector, low complexity, no privileges required, user interaction needed, unchanged scope, no confidentiality impact, low integrity impact, and high availability impact. The vulnerability affects Red Hat Enterprise Linux 10. The vendor advisory does not currently specify a patch or remediation status.

Successful exploitation can result in denial of service or limited information disclosure on affected systems running GNU Emacs on Red Hat Enterprise Linux 10. The attack requires local access and user interaction to open a malicious SVG file. There is no indication of remote exploitation or privilege escalation. No known exploits are reported in the wild.

Patch status is not yet confirmed — check the Red Hat advisory at https://access.redhat.com/security/cve/CVE-2026-6861 for current remediation guidance. Until a fix is available, users should exercise caution when opening SVG files from untrusted sources. No official fix or workaround is currently documented by Red Hat.