Loading story…
CERT Polska disclosed four vulnerabilities in GNU Emacs for Android affecting versions through 30.2, tracked as CVE-2026-71391, CVE-2026-71392, CVE-2026-71393, and CVE-2026-71394. The flaws are triggered by specially crafted TrueType font files that Emacs may load through email content, the EWW web browser, or documents using custom faces. CERT Polska said the bugs reside in src/sfnt.c and can lead to out-of-bounds reads, heap buffer overflows, use of uninitialized heap memory, information disclosure, application crashes, and possible code execution.
The disclosed issues include an off-by-one error (CWE-193), two integer overflows (CWE-190), and improper input validation in the font-parsing code. The vulnerabilities were responsibly reported by Michał Majchrowicz and Marcin Wyczechowski of the AFINE Team, and upstream fixes were released in specific commits referenced by CERT Polska as part of the coordinated disclosure.
See affected versions and whether adversaries are exploiting it.
1 event from the most recent confirmed update back to the earliest known activity.
CERT Polska disclosed and coordinated four vulnerabilities in GNU Emacs for Android: CVE-2026-71391, CVE-2026-71392, CVE-2026-71393, and CVE-2026-71394. The issues affect GNU Emacs through version 30.2 and can be triggered by crafted TrueType font files loaded via email, EWW, or documents with custom faces.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
3 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
A newly disclosed GNU Emacs vulnerability allows **arbitrary code execution** when a user opens a malicious file, affecting Emacs **28.1 and later**. The issue was reported by researcher **Eshel Yaron** and discussed on both `oss-sec` and `emacs-devel`, where maintainers treated it as serious enough to factor into Emacs 31 release decisions. The flaw is tied to unsafe handling of `read-symbol-shorthands` around risky `intern` calls, with discussion highlighting the VC-related attack path as one of the easiest ways to trigger the bug. Upstream published a workaround patch for the **Emacs 31** branch and committed a broader rework on `master`, while **Gentoo** backported fixes that nullify `read-symbol-shorthands` around vulnerable code paths and shipped updated packages for **28.2**, **29.4**, and **30.2**. Gentoo later issued **GLSA-202608-18**, and Tenable released a Nessus detection plugin for affected Gentoo installations. As an interim mitigation, users were advised to disable **file-local variables** if they cannot immediately apply patched versions.
Aug 20, 2026
German government CERT advisories disclosed multiple vulnerabilities in **FontForge** packages for **Red Hat Enterprise Linux**, warning that the flaws could allow **arbitrary code execution**. One advisory described **multiple vulnerabilities** affecting the font editor, while a later notice highlighted an additional vulnerability with the same impact, indicating continued security issues in the software component. The notices identify FontForge on Red Hat Enterprise Linux as the affected product and classify the risk as code execution, a high-impact outcome that can let attackers run malicious code on vulnerable systems. Organizations using FontForge in Red Hat Enterprise Linux environments should review the relevant vendor advisories, determine affected package versions, and prioritize patching or other remediation to reduce exposure.
Jun 29, 2026
Two high-severity vulnerabilities were disclosed in **MolotovCherry Android-ImageMagick7**, affecting releases prior to `7.1.2-10` and `7.1.2-11`. **CVE-2026-33854** is an out-of-bounds write flaw classified as `CWE-787`, which can lead to memory corruption and carries a CVSS v3.1 vector of `AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H`. **CVE-2026-4755** is an improper input validation issue classified as `CWE-20`, affecting versions before `7.1.2-11` with a CVSS v3.1 vector of `AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H`. The disclosures indicate both flaws could have severe impact on confidentiality, integrity, and availability, with the input validation bug standing out because it is network-exploitable and requires no privileges or user interaction. References added to the CVE records point to GitHub pull requests, including **PR #193**, suggesting fixes or remediation work is available upstream. Organizations using Android-ImageMagick7 should identify exposed deployments and prioritize upgrades to patched versions.
Jun 29, 2026