Executive brief
GNU Emacs for Android can load TrueType font files from various sources including email attachments and web content. A malicious font file with a specially crafted header can trigger an integer overflow when calculating memory allocation, resulting in heap corruption and potential execution of attacker code. This could allow unauthorized access to system resources or data on affected devices.
Technical details
This vulnerability is an integer overflow (CWE-190) in the sfnt_read_name_table() function in src/sfnt.c. The function computes an allocation size using a 32-bit length value from a TrueType font file without performing overflow checks. On 32-bit targets, a crafted font causes this calculation to wrap around, resulting in an undersized heap allocation. A subsequent read() call then writes beyond the allocated buffer boundaries, causing a heap buffer overflow. An attacker can deliver a malicious font file via email, the EWW web browser, or documents with custom faces, causing Emacs to load and parse it. The fix was applied in commit d51a4722316efe0960994d371e1859099894d1ca.
Affected products
- GNU Emacs through 30.2
Timeline
- 2026-08-10: disclosed: CVE-2026-71393 published
- 2026: patched: Fix applied in commit d51a4722316efe0960994d371e1859099894d1ca