Loading vulnerability…
Integer overflow in GNU Emacs for Android TrueType font parsing
CVE-2026-71393 is an integer overflow in sfnt_read_name_table() in GNU Emacs for Android through version 30.2. The function calculates a heap allocation size using a 32-bit length value from a TrueType font without checking for overflow. On 32-bit targets, a crafted font can cause the calculation to wrap and produce an undersized allocation. A subsequent read() writes beyond the allocated buffer, causing heap memory corruption and potentially enabling code execution. Malicious fonts can be delivered through email, EWW (Emacs Web Wowser), or documents with custom faces that cause Emacs to load them.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Processing a crafted TrueType font on an affected 32-bit target can cause a heap buffer overflow and heap memory corruption, potentially leading to code execution.
If you can’t patch tonight, do this now.
Until patched builds are deployed, reduce exposure to untrusted TrueType font content in GNU Emacs for Android. Avoid opening untrusted email content, web content in EWW, or documents that may cause Emacs to load attacker-supplied fonts or custom faces. Prefer running on patched versions and, where possible, avoid 32-bit deployments for exposed use cases because the documented overflow condition is specifically exploitable on 32-bit targets.
Patch, then assume compromise.
Update GNU Emacs for Android to a version containing upstream fix commit d51a4722316efe0960994d371e1859099894d1ca. The exact first fixed release version is not specified.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
2 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.