GNU Emacs Android font parser bugs fixed
Four vulnerabilities in GNU Emacs for Android's font parser can be triggered by malicious TrueType fonts, causing memory corruption or code execution.
Sourcecert.pl — open the original
What to check
- Applies to
- The 4 CVEs named below. Whether you run an affected version is not assessed: check the versions the source lists.
- Exploitation
- No exploitation in the wild and no public exploit is recorded for the CVEs named.
CERT Polska coordinated disclosure of four vulnerabilities discovered by AFINE Team researchers in the sfnt.c font parsing code of GNU Emacs for Android. The flaws stem from improper bounds checking, integer overflows, and uninitialized memory handling when Emacs processes crafted TrueType variable font files, which can be delivered via email attachments, the built-in EWW web browser, or documents referencing custom faces.
The most severe issues, CVE-2026-71392 and CVE-2026-71393, involve integer overflows in cmap and name table parsing routines that wrap allocation sizes on 32-bit builds, leading to heap buffer overflows with potential for arbitrary code execution. CVE-2026-71391 is an off-by-one boundary check error enabling an out-of-bounds heap read useful for defeating ASLR, while CVE-2026-71394 results from an incorrect length comparison causing use of uninitialized heap memory, which could lead to information disclosure or crashes. All four issues have been fixed upstream via separate commits to the GNU Emacs source tree.
Exploitation requires convincing a victim to open a malicious font file through Emacs on Android, making this a targeted client-side attack vector rather than mass exploitation. No in-the-wild exploitation has been reported; this is a responsible disclosure resulting in patches, not an active campaign.
Mentioned in this report
Source reporting: https://cert.pl/en/posts/2026/08/CVE-2026-71391
Free public brief. Slack alerts on the vendors you run come with the paid plans, and a new account gets three days of them, no card.
What this brief leaves out
This page is the free tier: the write-up, the severity, the names. In the app the same report carries live profiles of the CVEs it names. The paid plans add the security research and news reporting the free tier leaves out.
It sits in a corpus of 16,433 reports from 149 sources, 661 of them written in the last seven days, and it grows through the day.
A new account starts with three days of all of it, no card, then keeps the government and CERT reporting free. Slack alerts are a paid-plan feature: name the vendors you run and Slack hears about the reports that touch them, not the rest of the week's. Nothing is charged unless you subscribe.
Create a free account What it costs