CVE-2026-71392: 
Emacs vulnerability analysis and mitigation

CVE-2026-71392 is an integer overflow vulnerability in GNU Emacs for Android affecting the sfnt_read_cmap_format_12() function in src/sfnt.c. When processing a crafted TrueType font file, an unguarded integer addition in the xmalloc allocation call wraps around on 32-bit builds, triggering a heap buffer overflow write. All GNU Emacs versions up to and including 30.2 are affected. The vulnerability was published on August 10, 2026, and assigned by CERT-PL. It carries a CVSS v4.0 base score of 5.3 (Medium) (GitHub Advisory).

The root cause is an integer overflow (CWE-190) in the sfnt_read_cmap_format_12() function within src/sfnt.c of GNU Emacs. On 32-bit builds, an unguarded arithmetic addition used to compute the size argument passed to xmalloc can wrap around, resulting in a smaller-than-expected heap allocation. Subsequent writes to this undersized buffer constitute an out-of-bounds write (CWE-787), corrupting adjacent heap memory. An attacker exploits this by delivering a specially crafted TrueType font file through attack vectors such as email attachments, web content loaded via EWW (Emacs Web Wowser), or documents using custom font faces — all of which cause Emacs to parse the malicious font automatically. The fix was applied in commit c4e20777c26548722a37b03db93243e83a0d6188 (GitHub Advisory, Emacs Commit).

Successful exploitation results in heap memory corruption that can lead to arbitrary code execution with the privileges of the Emacs process on the victim's Android device. An unauthenticated remote attacker can achieve code execution by tricking a user into opening a malicious email, visiting a crafted web page in EWW, or opening a document with embedded custom font faces — requiring only passive user interaction. While the CVSS v4.0 scoring reflects low availability impact on the vulnerable system and low integrity impact on subsequent systems, the underlying heap corruption primitive carries a realistic potential for full process compromise (GitHub Advisory).

As of the time of publication, there is no known public proof-of-concept exploit and no evidence of in-the-wild exploitation (GitHub Advisory). The NVD SSVC assessment confirms exploitation is currently "none" and the vulnerability is not automatable. The EPSS score is approximately 0.39% (32nd percentile), indicating a low near-term exploitation probability. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. No threat actor attribution has been reported.

1. Craft malicious font file: Create a TrueType font file with a specially crafted cmap table format 12 subtable where the nGroups field is set to a value that, when used in the size calculation within sfnt_read_cmap_format_12(), causes an integer overflow on 32-bit builds, resulting in a smaller-than-expected xmalloc allocation.
2. Choose delivery vector: Select an appropriate delivery mechanism — embed the malicious font in an email attachment, host it on a web page accessible via EWW (Emacs Web Wowser), or embed it in a document that specifies custom font faces.
3. Deliver to target: Send the crafted email to a victim running GNU Emacs for Android (version ≤ 30.2) on a 32-bit device, or lure the victim to open the malicious document or URL in Emacs.
4. Trigger font parsing: When the victim opens the email, document, or web page, Emacs automatically loads and parses the embedded TrueType font, invoking sfnt_read_cmap_format_12() with the malicious input.
5. Exploit heap overflow: The integer overflow causes xmalloc to allocate an undersized buffer; subsequent writes overflow into adjacent heap memory, corrupting heap metadata or adjacent objects.
6. Achieve code execution: Leverage the heap corruption to redirect control flow and execute arbitrary code with the privileges of the Emacs process on the victim's Android device (GitHub Advisory).

• File System: Presence of unexpected or unknown TrueType font files (.ttf) in Emacs cache directories, email attachment directories, or temporary folders on Android.
• Process: Unusual child processes spawned by the Emacs process on Android; unexpected network connections initiated by the Emacs process following font file loading.
• Logs: Emacs crash logs or tombstone files on Android referencing sfnt_read_cmap_format_12 or src/sfnt.c in stack traces; heap corruption error messages in Emacs stderr or Android logcat output.
• Network: Outbound connections from the Emacs process to unexpected remote hosts shortly after opening an email, EWW page, or document with custom fonts.

Apply the fix included in commit c4e20777c26548722a37b03db93243e83a0d6188 to the Emacs source tree and rebuild, or upgrade to a version of GNU Emacs that incorporates this commit (post-30.2) (Emacs Commit). Until patching is possible, users should avoid opening untrusted email attachments, documents with custom font faces, or untrusted URLs in EWW. Consider disabling custom font loading in Emacs configuration where feasible. Users on 64-bit builds are not affected by the integer wraparound, but upgrading remains the recommended long-term solution (GitHub Advisory).

The vulnerability was assigned and disclosed by CERT-PL, which published a related post covering this and a companion CVE (CVE-2026-71391) (CERT-PL Post). No significant vendor statements beyond the upstream Emacs commit, nor notable researcher commentary or broad media coverage, have been identified at this time.