Input Validation Flaw in GNU Emacs for Android

CVE-2026-71394

What is CVE-2026-71394?

A vulnerability in GNU Emacs for Android has been identified that fails to properly validate the table header input during the parsing of font files. Specifically, an incorrect comparison variable in the read-length check allows a specially crafted font file to report more table directory entries than actually present. This oversight can result in the parser returning a structure containing uninitialized heap memory. An attacker could exploit this flaw by delivering a malicious font file through various channels, including email or documents with custom faces. The repercussions may include uninitialized heap data being accessed during subsequent table lookups, which could ultimately lead to information disclosure, application crashes, or arbitrary memory access on 32-bit systems. The issue is resolved in later commits, ensuring improved security for users.

References