Executive brief
GNU Emacs is a text editor that can render documents with custom fonts and web content via EWW (Emacs Web Wowser). An attacker can craft a malicious TrueType variable font file and deliver it via email, web pages, or documents. When Emacs loads this font, a boundary check error allows the parser to read beyond heap memory limits, exposing sensitive data that could be used to bypass security protections like ASLR.
Technical details
The vulnerability is an off-by-one error (CWE-193) in the gvar table parser within src/sfnt.c in GNU Emacs for Android. The functions sfnt_vary_simple_glyph() and sfnt_vary_compound_glyph() use a strict greater-than comparison instead of greater-than-or-equal when validating shared-coordinate array indices, allowing an index equal to the boundary to pass the check. This permits a crafted TrueType variable font to trigger a heap-based out-of-bounds read via memcpy. An attacker can deliver the malicious font via email, web content (EWW), or documents with embedded custom faces. The exploit exposes heap memory contents that can defeat ASLR. The issue was fixed in commit 95ab9ef627b212d74d321c5bbb5b56a1be7b9fbe.
Affected products
- GNU Emacs through 30.2
Timeline
- 2026-08-10: disclosed
- 2026-08-10: patched: Fixed in commit 95ab9ef627b212d74d321c5bbb5b56a1be7b9fbe