CVE-2026-71394
Received Received - Intake

Heap Memory Corruption in GNU Emacs for Android

Publication date: 2026-08-10

Last updated on: 2026-08-10

Assigner: CERT.PL

Description
GNU Emacs for Android improperly validates the table header input in sfnt_read_table_directory() in src/sfnt.c. Due to an incorrect comparison variable in the read-length check, a crafted font file that claims to contain more table directory entries than actually present causes the parser to return a struct with uninitialized heap memory in the table directory entries. An attacker can deliver a malicious font file via email, EWW (Emacs Web Wowser), or documents with custom faces, causing Emacs to load it. This leads to the use of uninitialized heap data in subsequent table lookups, potentially resulting in information disclosure, crashes, or arbitrary memory access on 32-bit targets. This issue is fixed after commit 7621ee1d01229d50e5c0cddea6bf0b01095a62cf

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-10
Last Modified
2026-08-10
Generated
2026-08-10
AI Q&A
2026-08-10
EPSS Evaluated
N/A
NVD
CVE-2026-71394
EUVD
EUVD-2026-55257

Affected Vendors & Products

Showing 4 associated CPEs
Vendor Product Version / Range
gnu emacs to 7621ee1d01229d50e5c0cddea6bf0b01095a62cf (inc)
gnu emacs *
gnu emacs From 7621ee1d01229d50e5c0cddea6bf0b01095a62cf (inc)
gnu emacs From 95ab9ef627b212d74d321c5bbb5b56a1be7b9fbe (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-1284 The product receives input that is expected to specify a quantity (such as size or length), but it does not validate or incorrectly validates that the quantity has the required properties.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

GNU Emacs for Android has a flaw in how it reads font files. When processing a font file, Emacs incorrectly checks the number of table entries, leading to uninitialized memory being used in table lookups. This can cause crashes, information leaks, or arbitrary memory access on 32-bit systems if a specially crafted font file is loaded.

Detection Guidance

Detecting this vulnerability requires checking for uninitialized memory usage in GNU Emacs when processing font files. Monitor for crashes or memory corruption when Emacs loads custom fonts or documents with specific faces. No direct commands are provided in the context to detect this issue.

Impact Analysis

If you open a malicious font file in Emacs for Android, it could crash the app, expose sensitive data, or allow an attacker to run arbitrary code on your device. This is especially risky on 32-bit systems where memory corruption can have severe consequences.

Compliance Impact

This vulnerability could lead to unauthorized data access or disclosure, violating GDPR's confidentiality requirements or HIPAA's safeguards for protected health information. Organizations using Emacs for Android may face compliance risks if exploited.

Mitigation Strategies

Update GNU Emacs to the latest version after commit 7621ee1d01229d50e5c0cddea6bf0b01095a62cf. Avoid opening untrusted font files or documents with custom faces in Emacs until patched. Disable automatic font loading if possible.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-71394. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart