Loading vulnerability…
Integer overflow in GNU Emacs for Android TrueType font parsing
GNU Emacs for Android through version 30.2 contains an integer overflow in sfnt_read_cmap_format_12(). When a crafted TrueType font is processed on a 32-bit build, an unchecked addition in an xmalloc allocation-size calculation can wrap around, resulting in an undersized allocation and a heap buffer overflow write. Malicious fonts can be delivered through email, EWW (Emacs Web Wowser), or documents with custom faces that cause Emacs to load the font. The resulting heap memory corruption can potentially lead to arbitrary code execution.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Processing a malicious TrueType font on an affected 32-bit build can cause a heap buffer overflow write and heap memory corruption, potentially allowing arbitrary code execution within the Emacs process.
If you can’t patch tonight, do this now.
Until a patched version is deployed, reduce exposure to untrusted TrueType font content in Emacs on Android. Avoid opening untrusted email content, web content rendered through EWW, or documents that may cause Emacs to load attacker-supplied fonts or custom faces. Where operationally feasible, prefer environments not using affected 32-bit builds, since the documented wraparound condition is specific to 32-bit allocation arithmetic.
Patch, then assume compromise.
Apply upstream commit c4e20777c26548722a37b03db93243e83a0d6188 or upgrade to a GNU Emacs for Android version that includes this fix. A specific fixed release version is not identified.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
3 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.