CVE-2023-2491

Severity: high (CVSS 7.8 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.5% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2023-05-17 · updated 2026-06-17
Weakness: CWE-77

Description

A flaw was found in the Emacs text editor. Processing a specially crafted org-mode code with the "org-babel-execute:latex" function in ob-latex.el can result in arbitrary command execution. This CVE exists because of a CVE-2023-28617 security regression for the emacs package in Red Hat Enterprise Linux 8.8 and Red Hat Enterprise Linux 9.2.

Affected products

GNU Emacs: 26.1-9.el8, 27.2-8.el9
Red Hat Enterprise Linux: 8.0, 9.0
RedHat Enterprise Linux Eus: 8.8, 9.2
RedHat Enterprise Linux Server Aus: 8.8, 9.2
RedHat Enterprise Linux Server Tus: 8.8

References

https://access.redhat.com/errata/RHSA-2023:2626
https://access.redhat.com/errata/RHSA-2023:3104
https://access.redhat.com/security/cve/CVE-2023-2491
https://bugzilla.redhat.com/show_bug.cgi?id=2192873
https://access.redhat.com/errata/RHSA-2023:2626
https://access.redhat.com/errata/RHSA-2023:3104
https://access.redhat.com/security/cve/CVE-2023-2491
https://bugzilla.redhat.com/show_bug.cgi?id=2192873

Get alerted when CVE-2023-2491 or the next vulnerability affects your stack