Crafted TrueType Fonts Expose GNU Emacs for Android to Memory Corruption
Vulnerability Disclosure · 3 sources · Updated 3mo ago · First seen Aug 10, 2026
CERT Polska disclosed four vulnerabilities in GNU Emacs for Android affecting versions through 30.2, tracked as CVE-2026-71391, CVE-2026-71392, CVE-2026-71393, and CVE-2026-71394. The flaws are triggered by specially crafted TrueType font files that Emacs may load through email content, the EWW web browser, or documents using custom faces. CERT Polska said the bugs reside in src/sfnt.c and can lead to out-of-bounds reads, heap buffer overflows, use of uninitialized heap memory, information disclosure, application crashes, and possible code execution.
The disclosed issues include an off-by-one error (CWE-193), two integer overflows (CWE-190), and improper input validation in the font-parsing code. The vulnerabilities were responsibly reported by Michał Majchrowicz and Marcin Wyczechowski of the AFINE Team, and upstream fixes were released in specific commits referenced by CERT Polska as part of the coordinated disclosure.
