Description
GNU Emacs for Android is vulnerable to an integer overflow in the sfnt_read_cmap_format_12() function in src/sfnt.c. When processing a crafted TrueType font file, an unguarded addition in the xmalloc allocation call wraps around on 32-bit builds, causing a heap buffer overflow write. An attacker can deliver a malicious font file via email, EWW (Emacs Web Wowser), or documents with custom faces, causing Emacs to load it. This results in heap memory corruption that can lead to code execution.


This issue was fixed in commit c4e20777c26548722a37b03db93243e83a0d6188
Published: 2026-08-10
Score: 5.3 Medium
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

GNU Emacs for Android contains an integer overflow in the sfnt_read_cmap_format_12() function, which is called when interpreting TrueType font tables. A crafted font file triggers an unchecked addition in an xmalloc call, causing the 32‑bit allocation size to wrap around. This overflow corrupts heap memory and can be used by an attacker to execute arbitrary code. The flaw is a classic CWE‑190 integer overflow. The vulnerability only manifests when Emacs processes a malicious font file.

Affected Systems

The affected product is GNU Emacs running on Android, specifically the 32‑bit builds of Emacs for Android. No specific release version is listed, so any installed Emacs for Android build that has not been updated with the patch commit should be considered vulnerable.

Risk and Exploitability

The CVSS score of 5.3 indicates a moderate severity. EPSS data is not available, and the issue is not listed in the CISA KEV catalog. The likely attack vector is delivery of a malicious TrueType font via email attachment, an EWW (Emacs Web Wowser) page, or a document that uses custom faces. Because the flaw requires a crafted font file to be interpreted by Emacs, an attacker must have some vectors of delivering files that Emacs will load.

Generated by OpenCVE AI on August 10, 2026 at 11:51 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Update Emacs for Android to a version that includes the patch commit c4e20777c26548722a37b03db93243e83a0d6188.
  • If upgrade is not immediately possible, configure Emacs to disable or restrict custom font loading, for example by removing custom font support in EWW or preventing Emacs from loading custom faces in documents.
  • Avoid opening unknown email attachments or documents that may contain malicious fonts until a patch is applied.

Generated by OpenCVE AI on August 10, 2026 at 11:51 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Wed, 12 Aug 2026 00:15:00 +0000

Type Values Removed Values Added
References
Metrics threat_severity

None

 cvssV3_1

{'score': 7.8, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H'}

threat_severity

Important

Mon, 10 Aug 2026 10:30:00 +0000

Type Values Removed Values Added
Description GNU Emacs for Android is vulnerable to an integer overflow in the sfnt_read_cmap_format_12() function in src/sfnt.c. When processing a crafted TrueType font file, an unguarded addition in the xmalloc allocation call wraps around on 32-bit builds, causing a heap buffer overflow write. An attacker can deliver a malicious font file via email, EWW (Emacs Web Wowser), or documents with custom faces, causing Emacs to load it. This results in heap memory corruption that can lead to code execution. This issue was fixed in commit c4e20777c26548722a37b03db93243e83a0d6188
Title Integer Overflow in GNU Emacs for Android
First Time appeared Gnu
Gnu emacs
Weaknesses CWE-190
CPEs cpe:2.3:a:gnu:emacs:*:*:32_bit:*:*:*:*:*
cpe:2.3:a:gnu:emacs:*:*:android:*:*:*:*:*
Vendors & Products Gnu
Gnu emacs
References
Metrics cvssV4_0

{'score': 5.3, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:L/SC:N/SI:L/SA:N'}

Subscriptions

Gnu Emacs
cve-icon MITRE

Status: PUBLISHED

Assigner: CERT-PL

Published:

Updated: 2026-08-10T17:48:56.986Z

Reserved: 2026-08-06T09:25:32.311Z

Link: CVE-2026-71392

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Deferred

Published: 2026-08-10T11:17:28.397

Modified: 2026-08-28T15:26:19.533

Link: CVE-2026-71392

cve-icon Redhat

Severity : Important

Publid Date: 2026-08-10T10:22:26Z

Links: CVE-2026-71392 - Bugzilla

cve-icon OpenCVE Enrichment

Updated: 2026-08-10T12:00:06Z

Weaknesses
  • CWE-190

    Integer Overflow or Wraparound