CVE-2026-71394: 
Emacs vulnerability analysis and mitigation

CVE-2026-71394 is a memory disclosure vulnerability in GNU Emacs for Android affecting the font parsing component (sfnt_read_table_directory() in src/sfnt.c). An incorrect comparison variable in the read-length check allows a crafted font file to cause the parser to return a struct containing uninitialized heap memory in the table directory entries. All versions up to and including 30.2 are affected; the issue is fixed after commit 7621ee1d01229d50e5c0cddea6bf0b01095a62cf. It carries a CVSS v4.0 base score of 5.3 (Medium), assigned by CERT-PL and published on August 10, 2026 (GitHub Advisory).

The root cause is classified as CWE-1284 (Improper Validation of Specified Quantity in Input): the sfnt_read_table_directory() function in src/sfnt.c uses an incorrect comparison variable when checking the read length of the font table directory header. When a maliciously crafted font file claims to contain more table directory entries than are actually present in the file, the parser does not detect the discrepancy and returns a struct whose trailing table directory entries contain uninitialized heap memory. Subsequent font table lookups then operate on this uninitialized data. The attack vector is network-based with passive user interaction — an attacker must deliver the malicious font file to the victim via email, the EWW (Emacs Web Wowser) browser, or a document using custom faces, after which Emacs automatically loads the font (GitHub Advisory, CERT-PL).

Successful exploitation can result in information disclosure through exposure of uninitialized heap memory contents, application crashes (denial of service), or — on 32-bit targets — potentially arbitrary memory access. The vulnerability primarily affects the confidentiality and availability of the Emacs process on the victim's device; integrity impact on the vulnerable system is assessed as none, though subsequent system integrity and confidentiality are rated low. Lateral movement potential is limited, but heap memory disclosure could expose sensitive in-memory data such as credentials, session tokens, or document contents (GitHub Advisory).

No public proof-of-concept exploit is known, and there is no evidence of in-the-wild exploitation at this time (GitHub Advisory). The NVD SSVC assessment confirms exploitation is currently "none." The EPSS score is approximately 0.279% (21st percentile), indicating a low near-term exploitation probability. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. No threat actor attribution has been reported.

1. Craft malicious font file: Create a specially crafted font file (e.g., TrueType/OpenType format) whose table directory header claims a larger number of table entries than are actually present in the file, exploiting the incorrect comparison variable in sfnt_read_table_directory().
2. Deliver the font to the victim: Send the malicious font file to the target via email as an attachment, embed it in a web page accessible through EWW (Emacs Web Wowser), or include it in a document that specifies custom faces referencing the malicious font.
3. Trigger font loading: When the victim opens the email, browses to the page in EWW, or opens the document in Emacs for Android, Emacs automatically parses the font file, causing sfnt_read_table_directory() to return a struct with uninitialized heap memory.
4. Exploit uninitialized data: Subsequent font table lookups use the uninitialized heap data, potentially leaking heap memory contents to an attacker-controlled location (information disclosure), causing a crash, or — on 32-bit targets — enabling arbitrary memory access (GitHub Advisory, CERT-PL).

• File System: Unexpected or unfamiliar font files (.ttf, .otf) delivered via email attachments or downloaded through EWW to Emacs cache/temp directories.
• Logs: Emacs crash logs or error output referencing sfnt_read_table_directory or font parsing failures; unexpected Emacs process terminations on Android.
• Network: Outbound connections from the Emacs process to unfamiliar hosts following the loading of a font file (potential data exfiltration on 32-bit targets); HTTP requests via EWW to domains serving malicious font resources.
• Process: Emacs for Android process crashing or producing abnormal output shortly after rendering a document with custom faces or loading a remotely fetched font.

Apply the fix introduced after commit 7621ee1d01229d50e5c0cddea6bf0b01095a62cf in the GNU Emacs repository; users should update to any Emacs build incorporating this commit, as all versions through 30.2 are affected. As a workaround, avoid opening emails, EWW pages, or documents with custom faces from untrusted sources, and consider disabling automatic font loading from untrusted documents. Restricting network access for Emacs on Android can reduce the attack surface for delivery via EWW (GitHub Advisory).

The vulnerability was reported by CERT-PL as part of a broader research effort into GNU Emacs vulnerabilities (see the related CVE-2026-71391 advisory). Coverage has been limited to automated vulnerability tracking platforms (Vulners, VulDB, CVEFeed) and the Malware News aggregator, with no notable independent researcher commentary or significant social media discussion observed at this time (CERT-PL, Malware News).