GNU Emacs for Android suffers from an integer overflow in the sfnt_read_name_table() function in src/sfnt.c. The function calculates an allocation size using a 32‑bit length field from a TrueType font file without performing an overflow check. On 32‑bit Android targets the calculation can wrap, leading to an undersized heap allocation. A subsequent read() call writes past the end of the buffer, corrupting heap memory. A malicious font file delivered via email, Emacs Web Wowser (EWW), or documents that use custom faces can trigger this overflow, potentially allowing an attacker to execute arbitrary code. The weakness is categorized as CWE‑190.

The flaw affects GNU Emacs running on 32‑bit Android environments, as indicated by the associated CPEs. It applies to all Emacs builds prior to the fix commit d51a4722316efe0960994d371e1859099894d1ca. 64‑bit Android builds are not listed as affected and are therefore not known to be vulnerable.

The CVSS score of 5.3 rating the vulnerability as moderate severity. The EPSS score is not available, so the current exploitation likelihood is unknown, but the attack vector requires an attacker to deliver a crafted font file to the user—through email, EWW, or document opening—without needing elevated privileges. The vulnerability is not listed in the CISA KEV catalog, indicating no known widespread exploitation to date. If exploited, an attacker could corrupt the heap and potentially take control of the Emacs process.