GNU Emacs for Android has a flaw where it does not correctly validate the table header input in the function sfnt_read_table_directory() in src/sfnt.c. Because an incorrect comparison variable is used in the read‑length check, a crafted font file that claims to hold more table directory entries than are actually present can cause the parser to return a structure that contains uninitialized heap memory in the table directory entries. This is a classic case of CWE-1284, heap‑use‑of‑uninitialized‑memory. An attacker exploiting this can supply a malicious font file via email, the Emacs Web Wowser (EWW), or documents that define custom faces; when Emacs loads the font, the uninitialized data is subsequently used in table lookups, which may lead to information disclosure, crashes, or arbitrary memory access on 32‑bit targets.

The vulnerability affects all installations of GNU Emacs for Android that are built from source containing the sfnt.c code before the commit that fixes the bug (7621ee1d01229d50e5c0cddea6bf0b01095a62cf). No specific product versions are listed, so any earlier version may be vulnerable until the patch is applied.

The CVSS base score of 5.3 indicates a moderate severity vulnerability, and the EPSS score is not available, so the exploitation probability is unknown but should be considered non‑negligible. The vulnerability is not listed in CISA’s KEV catalog, and no public exploits are documented. Attackers would need to deliver a maliciously crafted font file and convince a user to open it with Emacs. The impact could range from application crashes to leakage of sensitive data or memory corruption, especially on 32‑bit targets where the uninitialized data could be accessed arbitrarily.