Riskcovery

CVE-2026-71393

Heap Buffer Overflow in GNU Emacs for Android

State
Published
Severity
5.3 Medium
Published
Aug 10, 2026
Updated
Aug 10, 2026
Reserved
Aug 6, 2026

Read the record on cve.org

Description

GNU Emacs for Android is vulnerable to an integer overflow in sfnt_read_name_table() in src/sfnt.c. The function computes an allocation size using a 32-bit length value from a TrueType font file without overflow checking. On 32-bit targets, a crafted font causes the calculation to wrap, resulting in an undersized heap allocation. A subsequent read() call writes beyond the buffer, causing a heap buffer overflow. An attacker can deliver a malicious font file via email, EWW (Emacs Web Wowser), or documents with custom faces, causing Emacs to load it. This can lead to heap memory corruption and potential code execution.

This issue was fixed in commit d51a4722316efe0960994d371e1859099894d1ca

Scores

CVSSScoreVectorSource
4.05.3 MediumCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:L/SC:N/SI:L/SA:NCERT-PL

Weaknesses

  • CWE-190 Integer Overflow or Wraparound

Affected Products

ProductVersions
EmacsGNU
  • 30.2 and earlierAffectedfrom commit d51a4722316efe0960994d371e1859099894d1caNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.