CVE-2024-30204

What it actually does

Default enablement of LaTeX preview for email attachments in Emacs allows automatic processing of potentially untrusted content.

Why it matters to the business

Organizations using Emacs for email may face increased risk of exposure to malicious attachments without explicit user action, potentially leading to code execution or system compromise.

How an attack unfolds

An attacker crafts a malicious LaTeX attachment, sends it via email; the recipient's Emacs with org-mode automatically previews it due to the default setting, executing the embedded code.

How to fix it

Upgrade Emacs to version 29.3 or later, or apply the fix from commit 5ff4d54c6fa527f478035467ffe0a82a81a92320 in org-mode.

How to confirm the fix worked

Verify Emacs version is 29.3 or higher; check org-mode configuration for LaTeX preview settings on attachments.

Typical attack path

1. Send malicious email with LaTeX attachment
2. Victim opens email in Emacs
3. LaTeX preview triggers automatically
4. Malicious code executes

How to detect it

Review email logs and Emacs process activity for unexpected LaTeX compilations or executions triggered by attachments.

What your security team should do

• Update Emacs and org-mode to fixed versions immediately
• Review and disable LaTeX preview for email attachments if not needed
• Monitor for unusual process executions from Emacs