Skip to content
Sign in
5.3 Medium

CVE-2026-71393 GNU Emacs for Android is vulnerable to an integer overflow in sfnt_read_name_table() in src/sfnt.c

Description

GNU Emacs for Android is vulnerable to an integer overflow in sfnt_read_name_table() in src/sfnt.c. The function computes an allocation size using a 32-bit length value from a TrueType font file without overflow checking. On 32-bit targets, a crafted font causes the calculation to wrap, resulting in an undersized heap allocation. A subsequent read() call writes beyond the buffer, causing a heap buffer overflow. An attacker can deliver a malicious font file via email, EWW (Emacs Web Wowser), or documents with custom faces, causing Emacs to load it. This can lead to heap memory corruption and potential code execution. This issue was fixed in commit d51a4722316efe0960994d371e1859099894d1ca

Affected products and versions

Product Affected versions Fixed in
Emacs 30.2 earliest → 30.2 No fix stated

Other CVEs of Emacs

The 9 CVEs of Emacs →
CVE-2026-108976 GNU Emacs before 31.2 (and TRAMP through 2.8.2) allows OS command injection via a filename because tramp-user-regexp has… 7.8 High CVE-2026-96269 GNU Emacs 28.1 through 31.1 allows arbitrary code execution upon opening a file, because an untrusted value of… 7.5 High CVE-2026-77219 GNU Emacs before 31.0.91 contains an integer overflow in the PBM/PPM/PGM image loader that allows an attacker to leak… 6.9 Medium CVE-2026-71394 GNU Emacs for Android improperly validates the table header input in sfnt_read_table_directory() in src/sfnt.c 5.3 Medium
Track this CVE