CVE-2026-71394
MediumCVSS 5.3Exploitation Probability (EPSS)
Low risk20th percentile - higher than 20% of all known CVEs
Summary
GNU Emacs for Android improperly validates table header input in sfnt_read_table_directory() in src/sfnt.c. Due to an incorrect comparison variable in the read-length check, a crafted font file can cause the parser to return a struct with uninitialized heap memory in table directory entries. This can lead to information disclosure, crashes, or arbitrary memory access on 32-bit targets.
Risk Assessment
An attacker can deliver a malicious font file, potentially leading to leakage of sensitive data, application crashes, or potential code execution in the context of Emacs.
Recommendation
Update GNU Emacs to a version containing commit 7621ee1d01229d50e5c0cddea6bf0b01095a62cf or later. Avoid opening untrusted font files.
Other vulnerabilities in GNU Emacs
See all- CVE-2017-14482High
GNU Emacs before 25.3 allows remote attackers to execute arbitrary code via email with crafted 'Content-Type: text/enriched' data. In particular, an Emacs user can be instantly compromised by reading a crafted email message.
- CVE-2026-96269High
GNU Emacs 28.1 through 31.1 allows arbitrary code execution upon opening a file, because an untrusted value of read-symbol-shorthands affects the intern and unintern functions. This affects the default configuration; no particular user settings are required to trigger it.
- CVE-2026-77219High
GNU Emacs before 31.0.91 has an integer overflow in the PBM/PPM/PGM image loader. An attacker can supply a crafted image with large dimensions and an elevated max color index, leading to heap memory content leakage.
- CVE-2026-71393Medium
GNU Emacs for Android is vulnerable to an integer overflow in sfnt_read_name_table() in src/sfnt.c. The function computes an allocation size using a 32-bit length value from a TrueType font file without overflow checking. On 32-bit targets, a crafted font causes the calculation to wrap, resulting in an undersized heap allocation and subsequent heap buffer overflow during read.
- CVE-2026-71392Medium
GNU Emacs for Android is vulnerable to an integer overflow in the sfnt_read_cmap_format_12() function in src/sfnt.c. When processing a crafted TrueType font file, an unguarded addition in the xmalloc allocation call wraps around on 32-bit builds, causing a heap buffer overflow write. This can lead to heap memory corruption and potential code execution.
- CVE-2026-71391Medium
GNU Emacs for Android contains an off-by-one error in the gvar table parser in src/sfnt.c. The shared-coordinate index boundary check in sfnt_vary_simple_glyph() and sfnt_vary_compound_glyph() uses a strict greater-than comparison instead of greater-than-or-equal, allowing a crafted TrueType variable font to bypass the check and trigger a heap-based out-of-bounds read via memcpy. This exposes heap memory contents which can be later used to defeat ASLR.
- CVE-2024-53920High
In elisp-mode.el in GNU Emacs before 30.1, invoking elisp-completion-at-point on untrusted Emacs Lisp source code can trigger unsafe Lisp macro expansion, allowing arbitrary code execution. This also occurs if on-the-fly byte compilation diagnosis is enabled.
Original NVD description (English source)
GNU Emacs for Android improperly validates the table header input in sfnt_read_table_directory() in src/sfnt.c. Due to an incorrect comparison variable in the read-length check, a crafted font file that claims to contain more table directory entries than actually present causes the parser to return a struct with uninitialized heap memory in the table directory entries. An attacker can deliver a malicious font file via email, EWW (Emacs Web Wowser), or documents with custom faces, causing Emacs to load it. This leads to the use of uninitialized heap data in subsequent table lookups, potentially resulting in information disclosure, crashes, or arbitrary memory access on 32-bit targets. This issue is fixed after commit 7621ee1d01229d50e5c0cddea6bf0b01095a62cf
Vulnerability data from NVD (NIST) · CISA KEV · EPSS