CVE-2026-71391

Name of the Vulnerable Software and Affected Versions GNU Emacs for Android (affected versions not specified)

Description An off-by-one error exists in the gvar table parser within src/sfnt.c. The shared-coordinate index boundary check in the functions sfnt vary simple glyph() and sfnt vary compound glyph() utilizes a strict greater-than comparison instead of greater-than-or-equal. This allows a specially crafted TrueType variable font to bypass the check and trigger a heap-based out-of-bounds read via memcpy. An attacker can deliver a malicious font file through email, EWW (Emacs Web Wowser), or documents with custom faces. This flaw exposes heap memory contents, which can be used to defeat ASLR (Address Space Layout Randomization), a security technique that randomly arranges the address space positions of key data areas of a process to prevent exploitation of memory vulnerabilities.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.