CVE-2026-71391
Received Received - Intake

Off-by-One Heap Overflow in GNU Emacs for Android

Publication date: 2026-08-10

Last updated on: 2026-08-10

Assigner: CERT.PL

Description
GNU Emacs for Android contains an off-by-one error in the gvar table parser in src/sfnt.c. The shared-coordinate index boundary check in sfnt_vary_simple_glyph() and sfnt_vary_compound_glyph() uses a strict greater-than comparison instead of greater-than-or-equal, allowing a crafted TrueType variable font to bypass the check and trigger a heap-based out-of-bounds read via memcpy. An attacker can deliver a malicious font file via email, EWW (Emacs Web Wowser), or documents with custom faces, causing Emacs to load it. This exposes heap memory contents which can be later used to defeat ASLR. This issue was fixed in commit 95ab9ef627b212d74d321c5bbb5b56a1be7b9fbe

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-10
Last Modified
2026-08-10
Generated
2026-08-10
AI Q&A
2026-08-10
EPSS Evaluated
N/A
NVD
CVE-2026-71391
EUVD
EUVD-2026-55260

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
gnu emacs *
gnu emacs to 30.2 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-193 A product calculates or uses an incorrect maximum or minimum value that is 1 more, or 1 less, than the correct value.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-71391 is an off-by-one error in GNU Emacs for Android's gvar table parser in src/sfnt.c. The vulnerability occurs in the shared-coordinate index boundary check within sfnt_vary_simple_glyph() and sfnt_vary_compound_glyph(). A strict greater-than comparison is used instead of greater-than-or-equal, allowing a crafted TrueType variable font to bypass the check and trigger a heap-based out-of-bounds read via memcpy.

Detection Guidance

Detecting this vulnerability requires checking for vulnerable versions of GNU Emacs for Android. Inspect installed Emacs versions and verify if they are below the patched commit 95ab9ef627b212d74d321c5bbb5b56a1be7b9fbe. Check font files loaded by Emacs for unusual TrueType variable fonts.

Impact Analysis

An attacker can deliver a malicious font file via email, EWW (Emacs Web Wowser), or documents with custom faces, causing Emacs to load it. This exposes heap memory contents which can be later used to defeat ASLR.

Compliance Impact

This vulnerability does not directly affect compliance with GDPR, HIPAA, or similar standards as it involves a technical flaw in font parsing that could lead to information disclosure via heap memory exposure. Compliance impacts would depend on how the vulnerability is exploited in a specific environment rather than the vulnerability itself.

Mitigation Strategies

Update GNU Emacs for Android to the latest version that includes the fix in commit 95ab9ef627b212d74d321c5bbb5b56a1be7b9fbe. Avoid opening untrusted font files or documents with custom faces in Emacs until patched.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-71391. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart