Description
GNU Emacs for Android contains an off-by-one error in the gvar table parser in src/sfnt.c. The shared-coordinate index boundary check in sfnt_vary_simple_glyph() and sfnt_vary_compound_glyph() uses a strict greater-than comparison instead of greater-than-or-equal, allowing a crafted TrueType variable font to bypass the check and trigger a heap-based out-of-bounds read via memcpy. An attacker can deliver a malicious font file via email, EWW (Emacs Web Wowser), or documents with custom faces, causing Emacs to load it. This exposes heap memory contents which can be later used to defeat ASLR.


This issue was fixed in commit 95ab9ef627b212d74d321c5bbb5b56a1be7b9fbe
Published: 2026-08-10
Score: 5.3 Medium
EPSS: n/a
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

An off-by-one error in GNU Emacs for Android’s gvar table parser allows a malicious TrueType variable font to skip a shared‑coordinate index boundary check. This results in a heap‑based out‑of‑bounds read that can leak heap contents, which an attacker may use to defeat address space layout randomization.

Affected Systems

All GNU Emacs for Android installations that have not applied the fix committed as 95ab9ef627b212d74d321c5bbb5b56a1be7b9fbe. No specific version line numbers are listed, so any pre‑fix instance is potentially vulnerable.

Risk and Exploitability

The CVSS score of 5.3 indicates a moderate severity. EPSS data is unavailable and the vulnerability is not listed in CISA’s KEV catalog, suggesting it is not currently a widely used exploit. Attacks require delivery of a crafted font file through email, the Emacs Web Wowser, or document files that Emacs processes. The open‑source nature of the software means that the vulnerability is easily reproducible, but no documented exploits are known. The primary risk is the exposure of heap memory that can undermine ASLR protections.

Generated by OpenCVE AI on August 10, 2026 at 11:25 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Update GNU Emacs for Android to a version that includes commit 95ab9ef627b212d74d321c5bbb5b56a1be7b9fbe, which corrects the off‑by‑one check in sfnt.c
  • Configure Emacs to reject or sanitize variable fonts before loading them, reducing the chance of OOB reads through crafted TrueType files
  • Consider disabling custom face loading or periodic font cache clearing if an update is not immediately available, to limit exposure to malicious font inputs

Generated by OpenCVE AI on August 10, 2026 at 11:25 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Mon, 10 Aug 2026 10:30:00 +0000

Type Values Removed Values Added
Description GNU Emacs for Android contains an off-by-one error in the gvar table parser in src/sfnt.c. The shared-coordinate index boundary check in sfnt_vary_simple_glyph() and sfnt_vary_compound_glyph() uses a strict greater-than comparison instead of greater-than-or-equal, allowing a crafted TrueType variable font to bypass the check and trigger a heap-based out-of-bounds read via memcpy. An attacker can deliver a malicious font file via email, EWW (Emacs Web Wowser), or documents with custom faces, causing Emacs to load it. This exposes heap memory contents which can be later used to defeat ASLR. This issue was fixed in commit 95ab9ef627b212d74d321c5bbb5b56a1be7b9fbe
Title Off-by-One Error in GNU Emacs for Android
First Time appeared Gnu
Gnu emacs
Weaknesses CWE-193
CPEs cpe:2.3:a:gnu:emacs:*:*:android:*:*:*:*:*
Vendors & Products Gnu
Gnu emacs
References
Metrics cvssV4_0

{'score': 5.3, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:N/SA:N'}

Subscriptions

Gnu Emacs
cve-icon MITRE

Status: PUBLISHED

Assigner: CERT-PL

Published:

Updated: 2026-08-10T10:22:17.532Z

Reserved: 2026-08-06T09:25:32.311Z

Link: CVE-2026-71391

cve-icon Vulnrichment

No data.

cve-icon NVD

No data.

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-08-10T11:30:16Z

Weaknesses