Integer Overflow Vulnerability in GNU Emacs for Android
CVE-2026-71393

5.3MEDIUM

Key Information:

Vendor

Gnu
Status
Emacs
Vendor
CVE Published:
10 August 2026

What is CVE-2026-71393?

GNU Emacs for Android is susceptible to an integer overflow vulnerability within the sfnt_read_name_table() function found in src/sfnt.c. This issue arises when the function computes an allocation size based on a 32-bit length value from a TrueType font file without proper overflow validation. On 32-bit systems, attackers can craft a malicious font that causes the allocation calculation to wrap, leading to insufficient heap memory allocation. As a result, a subsequent read() operation can overflow the allocated buffer, resulting in heap memory corruption. Attackers can exploit this vulnerability by delivering specially crafted font files through various channels, including email or the Emacs Web Wowser, potentially allowing for remote code execution.

Affected Version(s)

Emacs Android 0 <= 30.2

References

https://cert.pl/en/posts/2026/08/CVE-2026-71391
third-party-advisory
https://www.gnu.org/savannah-checkouts/gnu/emacs/emacs.html
product
https://git.savannah.gnu.org/cgit/emacs.git/commit/?id=d5...
patch

CVSS V4

Score:
5.3
Severity:
MEDIUM
Confidentiality:
None
Integrity:
None
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
Unknown

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Michał Majchrowicz (AFINE Team)
Marcin Wyczechowski (AFINE Team)
.