# GNU Emacs Android font parser bugs fixed

Published: 2026-08-10 · Severity: routine
Canonical: https://vorant.io/reports/a3d6e9a2-1f34-578e-84a0-c52a2e31fb6f/gnu-emacs-android-font-parser-bugs-fixed

> Four vulnerabilities in GNU Emacs for Android's font parser can be triggered by malicious TrueType fonts, causing memory corruption or code execution.

CERT Polska coordinated disclosure of four vulnerabilities discovered by AFINE Team researchers in the sfnt.c font parsing code of GNU Emacs for Android. The flaws stem from improper bounds checking, integer overflows, and uninitialized memory handling when Emacs processes crafted TrueType variable font files, which can be delivered via email attachments, the built-in EWW web browser, or documents referencing custom faces.

The most severe issues, CVE-2026-71392 and CVE-2026-71393, involve integer overflows in cmap and name table parsing routines that wrap allocation sizes on 32-bit builds, leading to heap buffer overflows with potential for arbitrary code execution. CVE-2026-71391 is an off-by-one boundary check error enabling an out-of-bounds heap read useful for defeating ASLR, while CVE-2026-71394 results from an incorrect length comparison causing use of uninitialized heap memory, which could lead to information disclosure or crashes. All four issues have been fixed upstream via separate commits to the GNU Emacs source tree.

Exploitation requires convincing a victim to open a malicious font file through Emacs on Android, making this a targeted client-side attack vector rather than mass exploitation. No in-the-wild exploitation has been reported; this is a responsible disclosure resulting in patches, not an active campaign.

## Mentioned in this report

- Vulnerabilities: CVE-2026-71391, CVE-2026-71392, CVE-2026-71393, CVE-2026-71394

Source reporting: https://cert.pl/en/posts/2026/08/CVE-2026-71391

---

This is the free public brief from Vorant Threat Intelligence. When citing, attribute "Vorant" and link https://vorant.io/reports/a3d6e9a2-1f34-578e-84a0-c52a2e31fb6f/gnu-emacs-android-font-parser-bugs-fixed.
Full IOC sets, deployable detections, the entity graph, TAXII 2.1 feed and real-time alerts: https://vorant.io/signup