Aller au contenu
en Se connecter
5.3 Moyenne

CVE-2026-71393 GNU Emacs for Android is vulnerable to an integer overflow in sfnt_read_name_table() in src/sfnt.c

Description

GNU Emacs for Android is vulnerable to an integer overflow in sfnt_read_name_table() in src/sfnt.c. The function computes an allocation size using a 32-bit length value from a TrueType font file without overflow checking. On 32-bit targets, a crafted font causes the calculation to wrap, resulting in an undersized heap allocation. A subsequent read() call writes beyond the buffer, causing a heap buffer overflow. An attacker can deliver a malicious font file via email, EWW (Emacs Web Wowser), or documents with custom faces, causing Emacs to load it. This can lead to heap memory corruption and potential code execution. This issue was fixed in commit d51a4722316efe0960994d371e1859099894d1ca

Produits et versions touchés

Produit Versions touchées Corrigé en
Emacs 30.2 premières → 30.2 Pas de correctif indiqué

Références

Chronologie

  1. Publiée
  2. Dernière modification

Autres CVE de Emacs

Les 9 CVE de Emacs →
CVE-2026-108976 GNU Emacs before 31.2 (and TRAMP through 2.8.2) allows OS command injection via a filename because tramp-user-regexp has… 7.8 Élevée CVE-2026-96269 GNU Emacs 28.1 through 31.1 allows arbitrary code execution upon opening a file, because an untrusted value of… 7.5 Élevée CVE-2026-77219 GNU Emacs before 31.0.91 contains an integer overflow in the PBM/PPM/PGM image loader that allows an attacker to leak… 6.9 Moyenne CVE-2026-71394 GNU Emacs for Android improperly validates the table header input in sfnt_read_table_directory() in src/sfnt.c 5.3 Moyenne
Suivre cette CVE