5.3
Moyenne
CVE-2026-71391 GNU Emacs for Android contains an off-by-one error in the gvar table parser in src/sfnt.c
Description
GNU Emacs for Android contains an off-by-one error in the gvar table parser in src/sfnt.c. The shared-coordinate index boundary check in sfnt_vary_simple_glyph() and sfnt_vary_compound_glyph() uses a strict greater-than comparison instead of greater-than-or-equal, allowing a crafted TrueType variable font to bypass the check and trigger a heap-based out-of-bounds read via memcpy. An attacker can deliver a malicious font file via email, EWW (Emacs Web Wowser), or documents with custom faces, causing Emacs to load it. This exposes heap memory contents which can be later used to defeat ASLR. This issue was fixed in commit 95ab9ef627b212d74d321c5bbb5b56a1be7b9fbe
Produits et versions touchés
| Produit | Versions touchées | Corrigé en |
|---|---|---|
| Emacs 30.2 | premières → 30.2 | Pas de correctif indiqué |
Références
- cert.pl cert.pl
- www.gnu.org www.gnu.org
- git.savannah.gnu.org git.savannah.gnu.org
Chronologie
- Publiée
- Dernière modification
Autres CVE de Emacs
Les 9 CVE de Emacs →
CVE-2026-108976
GNU Emacs before 31.2 (and TRAMP through 2.8.2) allows OS command injection via a filename because tramp-user-regexp has…
7.8
Élevée
CVE-2026-96269
GNU Emacs 28.1 through 31.1 allows arbitrary code execution upon opening a file, because an untrusted value of…
7.5
Élevée
CVE-2026-77219
GNU Emacs before 31.0.91 contains an integer overflow in the PBM/PPM/PGM image loader that allows an attacker to leak…
6.9
Moyenne
CVE-2026-71394
GNU Emacs for Android improperly validates the table header input in sfnt_read_table_directory() in src/sfnt.c
5.3
Moyenne