CVE-2026-77219: Integer Overflow or Wraparound in GNU Emacs

CVE-2026-77219 is an integer overflow vulnerability in GNU Emacs prior to version 31.0.91 affecting the PBM/PPM/PGM image loader. The vulnerability arises because the image loader multiplies image dimensions and channel count using signed integer arithmetic. When these values are sufficiently large, the multiplication result wraps to a negative number, bypassing bounds checks. This causes the pixel reader to access heap memory beyond the allocated buffer, resulting in an over-read. The leaked heap memory contents are then interpreted as pixel color values and rendered, potentially leaking sensitive memory contents to an attacker.

An attacker can craft a malicious image file with large dimensions and an elevated max color index to trigger the integer overflow and cause the image loader to read and render heap memory contents beyond the intended buffer. This leads to information disclosure through memory leakage. There is no indication of code execution or privilege escalation. The vulnerability requires local access (attack vector is local) and user interaction (opening the crafted image).

A fix is available in GNU Emacs version 31.0.91. Users should upgrade to version 31.0.91 or later to remediate this vulnerability. Patch status is confirmed by the versioning information indicating affected versions are prior to 31.0.91. No additional mitigations are specified.