Loading vulnerability…
Heap information disclosure in GNU Emacs for Android gvar parser
CVE-2026-71391 is an off-by-one error in the TrueType variable-font gvar table parser in GNU Emacs for Android through version 30.2. The shared-coordinate index checks in sfnt_vary_simple_glyph() and sfnt_vary_compound_glyph() use a strict greater-than comparison instead of greater-than-or-equal, allowing an invalid boundary index to pass validation. Processing a crafted font can consequently trigger a heap-based out-of-bounds read through memcpy and disclose heap memory contents.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation can disclose heap memory contents. The disclosed information may subsequently help defeat address space layout randomization (ASLR). Direct code execution is not established for this vulnerability.
If you can’t patch tonight, do this now.
Until a fixed version is deployed, reduce exposure by preventing Emacs for Android from processing untrusted or externally supplied TrueType variable fonts. Avoid opening attacker-controlled content that may trigger font loading, including email content, web content viewed through EWW, and documents using custom faces. Where possible, restrict workflows that allow automatic loading or rendering of untrusted font data.
Patch, then assume compromise.
Apply upstream commit 95ab9ef627b212d74d321c5bbb5b56a1be7b9fbe or upgrade GNU Emacs for Android to a version incorporating that fix. A specific fixed release version is not identified.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
2 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.