Loading vulnerability…
Uninitialized heap memory use in GNU Emacs for Android font parsing
CVE-2026-71394 affects GNU Emacs for Android through version 30.2. The sfnt_read_table_directory() function improperly validates font table directory input because its read-length check compares the wrong variable. A crafted font file declaring more table directory entries than are actually present can cause the parser to return a structure with uninitialized heap memory in its table directory entries. Subsequent table lookups can use this uninitialized data, potentially causing information disclosure, application crashes, or arbitrary memory access on 32-bit targets. Malicious fonts can reach Emacs through email, EWW, or documents with custom faces.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Processing a malicious font can cause subsequent table lookups to consume uninitialized heap data. Potential consequences include information disclosure, application crashes, and arbitrary memory access on 32-bit targets. Arbitrary code execution is not established for this vulnerability.
If you can’t patch tonight, do this now.
Until patched builds are deployed, reduce exposure to untrusted font parsing in GNU Emacs for Android. Avoid opening untrusted content that may cause automatic font loading, including email content, web content rendered through EWW, and documents using embedded or custom font faces. Where operationally feasible, restrict use of untrusted TrueType/OpenType fonts and prefer trusted content sources only.
Patch, then assume compromise.
Update GNU Emacs for Android to a patched build containing upstream commit 7621ee1d01229d50e5c0cddea6bf0b01095a62cf or later. GNU Emacs through version 30.2 is identified as affected; a specific fixed release number is not available.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
2 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.