@Suiseiseki There was a path-based execution vulnerability in Emacs for decades at some point, iirc. https://nvd.nist.gov/vuln/detail/CVE-2022-45939

https://www.technadu.com/dell-releases-fix-decades-old-vulnerability-affecting-100-million-pcs/272220/

First result on a search.

Neither of these compromised the functionality of the program noticeably to the users in the overwhelming majority of circumstances.

https://windowsreport.com/outlooks-decades-old-vulnerability-allowed-for-catastrophic-attacks-without-any-user-interaction/

And then there's this one. For what was once perceived as a flagship product (not some neglected thing everyone ignores).

http://blog.securitymouse.com/2014/06/raising-lazarus-20-year-old-bug-that.html

Versatile.

So yeah, it is definitely a risk and the popularity of the project doesn't seem to prevent it from happening.