5.3
Medium
CVE-2026-71391 GNU Emacs for Android contains an off-by-one error in the gvar table parser in src/sfnt.c
Description
GNU Emacs for Android contains an off-by-one error in the gvar table parser in src/sfnt.c. The shared-coordinate index boundary check in sfnt_vary_simple_glyph() and sfnt_vary_compound_glyph() uses a strict greater-than comparison instead of greater-than-or-equal, allowing a crafted TrueType variable font to bypass the check and trigger a heap-based out-of-bounds read via memcpy. An attacker can deliver a malicious font file via email, EWW (Emacs Web Wowser), or documents with custom faces, causing Emacs to load it. This exposes heap memory contents which can be later used to defeat ASLR. This issue was fixed in commit 95ab9ef627b212d74d321c5bbb5b56a1be7b9fbe
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| Emacs 30.2 | earliest → 30.2 | No fix stated |
References
- cert.pl cert.pl
- www.gnu.org www.gnu.org
- git.savannah.gnu.org git.savannah.gnu.org
Timeline
- Published
- Last modified
Other CVEs of Emacs
The 9 CVEs of Emacs →
CVE-2026-108976
GNU Emacs before 31.2 (and TRAMP through 2.8.2) allows OS command injection via a filename because tramp-user-regexp has…
7.8
High
CVE-2026-96269
GNU Emacs 28.1 through 31.1 allows arbitrary code execution upon opening a file, because an untrusted value of…
7.5
High
CVE-2026-77219
GNU Emacs before 31.0.91 contains an integer overflow in the PBM/PPM/PGM image loader that allows an attacker to leak…
6.9
Medium
CVE-2026-71394
GNU Emacs for Android improperly validates the table header input in sfnt_read_table_directory() in src/sfnt.c
5.3
Medium