5.3
Medium
CVE-2026-71392 GNU Emacs for Android is vulnerable to an integer overflow in the sfnt_read_cmap_format_12() function in src/sfnt.c
Description
GNU Emacs for Android is vulnerable to an integer overflow in the sfnt_read_cmap_format_12() function in src/sfnt.c. When processing a crafted TrueType font file, an unguarded addition in the xmalloc allocation call wraps around on 32-bit builds, causing a heap buffer overflow write. An attacker can deliver a malicious font file via email, EWW (Emacs Web Wowser), or documents with custom faces, causing Emacs to load it. This results in heap memory corruption that can lead to code execution. This issue was fixed in commit c4e20777c26548722a37b03db93243e83a0d6188
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| Emacs 30.2 | earliest → 30.2 | No fix stated |
References
- cert.pl cert.pl
- www.gnu.org www.gnu.org
- git.savannah.gnu.org git.savannah.gnu.org
Timeline
- Published
- Last modified
Other CVEs of Emacs
The 9 CVEs of Emacs →
CVE-2026-108976
GNU Emacs before 31.2 (and TRAMP through 2.8.2) allows OS command injection via a filename because tramp-user-regexp has…
7.8
High
CVE-2026-96269
GNU Emacs 28.1 through 31.1 allows arbitrary code execution upon opening a file, because an untrusted value of…
7.5
High
CVE-2026-77219
GNU Emacs before 31.0.91 contains an integer overflow in the PBM/PPM/PGM image loader that allows an attacker to leak…
6.9
Medium
CVE-2026-71394
GNU Emacs for Android improperly validates the table header input in sfnt_read_table_directory() in src/sfnt.c
5.3
Medium