CVE-2026-6861: Off-by-one Error in Red Hat Red Hat Enterprise Linux 10
CVE-2026-6861 is a medium severity vulnerability in GNU Emacs on Red Hat Enterprise Linux 10 caused by an off-by-one memory corruption error when processing specially crafted SVG CSS data. A local user could exploit this by convincing a victim to open a malicious SVG file, potentially causing denial of service or limited information disclosure. There is no explicit vendor advisory statement on patch availability or remediation level. No known exploits in the wild have been reported.
AI Analysis
Technical Summary
This vulnerability involves a memory corruption issue in GNU Emacs triggered by processing maliciously crafted SVG CSS data. The off-by-one error can be exploited locally via user interaction (opening a crafted SVG file) to cause denial of service or limited information disclosure. The CVSS 3.1 score is 6.1 (medium), reflecting local attack vector with low privileges required and user interaction needed. The vendor advisory from Red Hat does not specify a remediation level or patch availability at this time.
Potential Impact
Successful exploitation may lead to denial of service or limited information disclosure on affected Red Hat Enterprise Linux 10 systems running GNU Emacs. The attack requires local user access and user interaction to open a malicious SVG file. There are no reports of active exploitation in the wild.
Mitigation Recommendations
Patch status is not yet confirmed — check the Red Hat advisory at https://access.redhat.com/security/cve/CVE-2026-6861 for current remediation guidance. Until a patch or official fix is available, users should avoid opening untrusted SVG files with GNU Emacs to mitigate risk.
CVE-2026-6861: Off-by-one Error in Red Hat Red Hat Enterprise Linux 10
Description
CVE-2026-6861 is a medium severity vulnerability in GNU Emacs on Red Hat Enterprise Linux 10 caused by an off-by-one memory corruption error when processing specially crafted SVG CSS data. A local user could exploit this by convincing a victim to open a malicious SVG file, potentially causing denial of service or limited information disclosure. There is no explicit vendor advisory statement on patch availability or remediation level. No known exploits in the wild have been reported.
CVSS v3.1
Score 6.1medium
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
This vulnerability involves a memory corruption issue in GNU Emacs triggered by processing maliciously crafted SVG CSS data. The off-by-one error can be exploited locally via user interaction (opening a crafted SVG file) to cause denial of service or limited information disclosure. The CVSS 3.1 score is 6.1 (medium), reflecting local attack vector with low privileges required and user interaction needed. The vendor advisory from Red Hat does not specify a remediation level or patch availability at this time.
Potential Impact
Successful exploitation may lead to denial of service or limited information disclosure on affected Red Hat Enterprise Linux 10 systems running GNU Emacs. The attack requires local user access and user interaction to open a malicious SVG file. There are no reports of active exploitation in the wild.
Mitigation Recommendations
Patch status is not yet confirmed — check the Red Hat advisory at https://access.redhat.com/security/cve/CVE-2026-6861 for current remediation guidance. Until a patch or official fix is available, users should avoid opening untrusted SVG files with GNU Emacs to mitigate risk.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- redhat
- Date Reserved
- 2026-04-22T13:05:41.130Z
- Cvss Version
- 3.1
- State
- PUBLISHED
- Remediation Level
- null
- Vendor Advisory Urls
- [{"url":"https://access.redhat.com/security/cve/CVE-2026-6861","vendor":"Red Hat"}]
Threat ID: 69e8d83619fe3cd2cdbdacad
Added to database: 4/22/2026, 2:16:22 PM
Last enriched: 5/28/2026, 9:21:07 PM
Last updated: 6/6/2026, 6:58:49 PM
Views: 94
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.