# CVE-2026-71391: GNU Emacs off-by-one error in gvar table parser

Source: https://junglewise.ai/threats/cve-2026-71391-gnu-emacs-off-by-one-error-in-gvar-table-parser  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-08-10. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2026-71391 · Severity: info · CVSS 0 · Published 2026-08-10

GNU Emacs is a text editor that can render documents with custom fonts and web content via EWW (Emacs Web Wowser). An attacker can craft a malicious TrueType variable font file and deliver it via email, web pages, or documents. When Emacs loads this font, a boundary check error allows the parser to read beyond heap memory limits, exposing sensitive data that could be used to bypass security protections like ASLR.

Technologies: [Gnu Emacs](https://junglewise.ai/threats/technologies/emacs). Vendors: [Gnu](https://junglewise.ai/threats/vendors/gnu).

## Quick answers

**Is CVE-2026-71391 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-71391 being exploited in the wild.

**How severe is CVE-2026-71391?** Informational severity, with a CVSS score of 0, published 10 August 2026.

**Which products and versions are affected?** Gnu Emacs through 30.2.

**Is there a fix for CVE-2026-71391?** A patch was published on 2026-08-10: Fixed in commit 95ab9ef627b212d74d321c5bbb5b56a1be7b9fbe Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-71391 attacked?** It is attacked over the network.

**Am I affected by CVE-2026-71391?** Check whether you run Gnu Emacs at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The vulnerability is an off-by-one error (CWE-193) in the gvar table parser within src/sfnt.c in GNU Emacs for Android. The functions sfnt_vary_simple_glyph() and sfnt_vary_compound_glyph() use a strict greater-than comparison instead of greater-than-or-equal when validating shared-coordinate array indices, allowing an index equal to the boundary to pass the check. This permits a crafted TrueType variable font to trigger a heap-based out-of-bounds read via memcpy. An attacker can deliver the malicious font via email, web content (EWW), or documents with embedded custom faces. The exploit exposes heap memory contents that can defeat ASLR. The issue was fixed in commit 95ab9ef627b212d74d321c5bbb5b56a1be7b9fbe.

## Affected products

- GNU Emacs through 30.2

## Timeline

- 2026-08-10: disclosed
- 2026-08-10: patched: Fixed in commit 95ab9ef627b212d74d321c5bbb5b56a1be7b9fbe

## References

- [https://cert.pl/en/posts/2026/08/CVE-2026-71391](https://cert.pl/en/posts/2026/08/CVE-2026-71391)
- [https://git.savannah.gnu.org/cgit/emacs.git/commit/?id=95ab9ef627b212d74d321c5bbb5b56a1be7b9fbe](https://git.savannah.gnu.org/cgit/emacs.git/commit/?id=95ab9ef627b212d74d321c5bbb5b56a1be7b9fbe)

## Related threats

- [GNU Emacs command injection via TRAMP user field in filename](https://junglewise.ai/threats/cve-2026-108976-gnu-emacs-before-31-2-and-tramp-through-2-8-2-allows-os-command)
- [Emacs Flymake code execution via untrusted files](https://junglewise.ai/threats/cve-2026-96442-a-code-execution-flaw-was-found-in-emacs-affecting-versions-prior)
- [GNU Emacs arbitrary code execution in symbol handling](https://junglewise.ai/threats/cve-2026-96269-gnu-emacs-28-1-through-31-1-allows-arbitrary-code-execution-upon)
- [Emacs TRAMP command injection via malicious filenames](https://junglewise.ai/threats/cve-2026-79992-emacs-tramp-command-injection-via-malicious-filenames)
- [GNU Emacs integer overflow in PBM image loader](https://junglewise.ai/threats/cve-2026-77219-gnu-emacs-integer-overflow-in-pbm-image-loader)