CVE-2026-71393: 
Emacs vulnerability analysis and mitigation

CVE-2026-71393 is an integer overflow vulnerability in GNU Emacs for Android affecting the sfnt_read_name_table() function in src/sfnt.c. The flaw exists in versions up to and including 30.2 of GNU Emacs and was published on August 10, 2026. A crafted TrueType font file can trigger a heap buffer overflow, potentially leading to arbitrary code execution. It carries a CVSS v4.0 base score of 5.3 (Medium), assigned by CERT-PL (GitHub Advisory).

The root cause is an integer overflow (CWE-190) in sfnt_read_name_table() within src/sfnt.c, where a 32-bit length value read from a TrueType font file is used to compute a heap allocation size without bounds or overflow checking. On 32-bit targets, a specially crafted font can cause this arithmetic to wrap around, producing an undersized heap buffer. A subsequent read() call then writes data beyond the allocated buffer boundary, resulting in an out-of-bounds write (CWE-787) and heap memory corruption. The attack is delivered passively — an attacker embeds a malicious font in an email, a web page loaded via EWW (Emacs Web Wowser), or a document using custom faces, and Emacs loads the font automatically upon rendering (GitHub Advisory, CERT-PL).

Successful exploitation can result in heap memory corruption and potential arbitrary code execution with the privileges of the Emacs process on the victim's device. The vulnerability primarily affects availability (crash/corruption) and, in a successful code execution scenario, integrity of the subsequent system. Because the attack requires only passive user interaction (e.g., opening an email or document), the attack surface is broad for users of GNU Emacs for Android on 32-bit devices (GitHub Advisory).

No public proof-of-concept exploit is known, and there is no evidence of in-the-wild exploitation at this time. The NVD SSVC assessment classifies exploitation as "none" and the attack as non-automatable. The EPSS score is approximately 0.39% (32nd percentile), indicating a low near-term exploitation probability. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog (GitHub Advisory).

1. Craft malicious font: Create a TrueType font file with a manipulated name table length value designed to trigger integer overflow in sfnt_read_name_table() on 32-bit targets, causing the computed allocation size to wrap to a small value.
2. Deliver the payload: Embed the malicious font file in an email attachment, a web page accessible via EWW (Emacs Web Wowser), or a document that specifies custom faces referencing the crafted font.
3. Trigger font loading: Send the email or share the document/URL with the target. When the victim opens the content in GNU Emacs for Android (version ≤ 30.2 on a 32-bit device), Emacs automatically loads the font during rendering.
4. Heap buffer overflow: The undersized heap allocation is followed by a read() call that writes beyond the buffer boundary, corrupting adjacent heap memory.
5. Achieve code execution: With a carefully crafted font, an attacker may control the overflow data to overwrite heap metadata or function pointers, ultimately achieving arbitrary code execution with the privileges of the Emacs process (GitHub Advisory, CERT-PL).

• Process: Unexpected crashes or abnormal termination of the Emacs process on Android, particularly after opening emails, web pages via EWW, or documents with custom font faces.
• Logs: Android system logs (logcat) showing segmentation faults or heap corruption errors originating from the Emacs process, especially in contexts involving font rendering.
• File System: Presence of unexpected or unfamiliar TrueType font files (.ttf) in directories accessible to Emacs, or in email/document attachment caches.
• Network: Outbound network connections from the Emacs process to unexpected remote hosts following the rendering of a document or email (potential indicator of post-exploitation activity).

The vulnerability is fixed in commit d51a4722316efe0960994d371e1859099894d1ca in the GNU Emacs source repository. Users should update GNU Emacs for Android to a version that includes this patch. As an interim workaround, users should avoid opening emails, EWW web pages, or documents from untrusted sources that may contain embedded or referenced TrueType font files. The vulnerability is specific to 32-bit targets, so users on 64-bit Android devices are not affected by the integer overflow condition (GitHub Advisory, GNU Emacs Commit).

The vulnerability was assigned and disclosed by CERT-PL, which published a related advisory post. Coverage has been picked up by standard vulnerability tracking services including Vulners, VulDB, and CVEFeed. No notable researcher commentary or significant social media discussion has been identified beyond routine aggregation (CERT-PL).