CVE-2026-71393
Severity CVSS v4.0:
MEDIUM
Type:
CWE-190
Integer Overflow or Wraparound
Publication date:
10/08/2026
Last modified:
10/08/2026
Description
GNU Emacs for Android is vulnerable to an integer overflow in sfnt_read_name_table() in src/sfnt.c. The function computes an allocation size using a 32-bit length value from a TrueType font file without overflow checking. On 32-bit targets, a crafted font causes the calculation to wrap, resulting in an undersized heap allocation. A subsequent read() call writes beyond the buffer, causing a heap buffer overflow. An attacker can deliver a malicious font file via email, EWW (Emacs Web Wowser), or documents with custom faces, causing Emacs to load it. This can lead to heap memory corruption and potential code execution.<br />
<br />
<br />
<br />
<br />
This issue was fixed in commit d51a4722316efe0960994d371e1859099894d1ca
Impact
Base Score 4.0
5.30
Severity 4.0
MEDIUM