CVE-2026-71393

Name of the Vulnerable Software and Affected Versions GNU Emacs for Android (affected versions not specified)

Description An integer overflow exists in the sfnt read name table() function within src/sfnt.c. The issue occurs when the function calculates an allocation size using a 32-bit length value from a TrueType font file without performing overflow checks. On 32-bit targets, a specially crafted font file can cause the calculation to wrap, leading to an undersized heap allocation. A subsequent read() call then writes beyond the allocated buffer, resulting in a heap buffer overflow. This can be triggered if an attacker delivers a malicious font file via email, EWW (Emacs Web Wowser), or documents with custom faces, potentially leading to heap memory corruption and arbitrary code execution.

Recommendations Apply the fix provided in commit d51a4722316efe0960994d371e1859099894d1ca.