CVE-2008-1694: GNU Emacs

Medium severity, CVSS 4.6. EPSS: 0.4% chance of exploitation in the next 30 days.

vcdiff in Emacs 20.7 to 22.1.50, when used with SCCS, allows local users to overwrite arbitrary files via a symlink attack on temporary files.

Affected products

• GNU Emacs: version 20.7 only; version 21.1 only; version 21.2 only; version 21.3 only; version 21.4 only
• GNU Sccs: any version

Published 2008-04-22. Last modified 2026-06-16.