Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.

CVE-2026-71393: Emacs for Android may execute code via crafted font

CVE-2026-71393 · published 2 months ago

Summary

The Android version of GNU Emacs can be fooled by a specially crafted font file, which can cause memory corruption and potentially allow an attacker to run code. This can happen when a malicious font is opened through email, the built‑in web viewer, or documents that use custom fonts. Updating Emacs to the latest version that includes the fix will protect against this risk.

What to do

Update gnu emacs to version commit d51a4722316efe0960994d371e1859099894d1ca.

Affected software

Ecosystem	Vendor	Product	Affected versions
–	gnu	emacs	<= 30.2 Fix: upgrade to commit d51a4722316efe0960994d371e1859099894d1ca
Debian:11	debian	emacs	All versions
Debian:12	debian	emacs	All versions
Debian:13	debian	emacs	All versions
Debian:14	debian	emacs	All versions
Ubuntu:Pro:16.04:LTS	canonical	emacs24	All versions
Ubuntu:16.04:LTS	canonical	xemacs21	All versions
Ubuntu:16.04:LTS	canonical	xemacs21-packages	All versions
Ubuntu:Pro:18.04:LTS	canonical	emacs25	All versions
Ubuntu:Pro:20.04:LTS	canonical	emacs	All versions

Original advisory text

Heap Buffer Overflow in GNU Emacs for Android

GNU Emacs for Android is vulnerable to an integer overflow in sfnt_read_name_table() in src/sfnt.c. The function computes an allocation size using a 32-bit length value from a TrueType font file without overflow checking. On 32-bit targets, a crafted font causes the calculation to wrap, resulting in an undersized heap allocation. A subsequent read() call writes beyond the buffer, causing a heap buffer overflow. An attacker can deliver a malicious font file via email, EWW (Emacs Web Wowser), or documents with custom faces, causing Emacs to load it. This can lead to heap memory corruption and potential code execution.

This issue was fixed in commit d51a4722316efe0960994d371e1859099894d1ca

References

https://security-tracker.debian.org/tracker/CVE-2026-71393 Vendor Advisory
https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/71xxx/CVE-2026-71393... Vendor Advisory
https://nvd.nist.gov/vuln/detail/CVE-2026-71393 Vendor Advisory
https://cgit.git.savannah.gnu.org/cgit/emacs.git Product
https://ubuntu.com/security/CVE-2026-71393 Third Party Advisory
https://www.cve.org/CVERecord?id=CVE-2026-71393 Third Party Advisory
https://cert.pl/en/posts/2026/08/CVE-2026-71391 Vendor Advisory
https://www.gnu.org/savannah-checkouts/gnu/emacs/emacs.html URL
https://git.savannah.gnu.org/cgit/emacs.git/commit/?id=d51a4722316efe0960994d371... Patch

Fix within

Internet-facing 60 days

Internal At next upgrade

Not known to be exploited
Needs hands-on effort to exploit (estimated)
Gives an attacker partial control (estimated)

Severity

7.8 High

Exploitation

<1% chance of attack within 30 days

Type

CWE-190Integer Overflow

Timeline

Published10 Aug 2026

Updated4 Nov 2026

First seen10 Aug 2026

Sources

CVE-2026-71393 · NVD

CVE-2026-71393 · MITRE

DEBIAN-CVE-2026-71393 · OSV

CVE-2026-71393 · OSV

UBUNTU-CVE-2026-71393 · OSV

Track software like this

Free during beta