CVE-2026-71393 in Emacs
Summary
by MITRE • 08/10/2026
GNU Emacs for Android is vulnerable to an integer overflow in sfnt_read_name_table() in src/sfnt.c. The function computes an allocation size using a 32-bit length value from a TrueType font file without overflow checking. On 32-bit targets, a crafted font causes the calculation to wrap, resulting in an undersized heap allocation. A subsequent read() call writes beyond the buffer, causing a heap buffer overflow. An attacker can deliver a malicious font file via email, EWW (Emacs Web Wowser), or documents with custom faces, causing Emacs to load it. This can lead to heap memory corruption and potential code execution.
This issue was fixed in commit d51a4722316efe0960994d371e1859099894d1ca
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 08/10/2026
The vulnerability in GNU Emacs for Android represents a critical integer overflow flaw within the sfnt_read_name_table() function located in src/sfnt.c. This issue stems from improper handling of 32-bit length values extracted from TrueType font files without adequate overflow validation mechanisms. The flaw manifests when the function performs heap allocation calculations using these unvalidated length values, creating a scenario where crafted malicious inputs can manipulate memory allocation sizes. The vulnerability specifically targets 32-bit system architectures where integer wrapping occurs during arithmetic operations, leading to significantly smaller heap allocations than required for legitimate font data processing.
The technical execution path begins with the parsing of font metadata through the sfnt_read_name_table() function which reads length fields from font headers without proper bounds checking. When a maliciously crafted TrueType font file contains oversized length values that exceed 32-bit integer limits, the subsequent allocation calculation wraps around to produce a buffer size orders of magnitude smaller than necessary. This fundamental miscalculation creates a heap buffer overflow condition where subsequent read operations attempt to write data beyond allocated memory boundaries. The vulnerability operates under CWE-190 which categorizes integer overflow conditions as a primary class of memory corruption vulnerabilities, making it particularly dangerous for applications handling untrusted binary data streams.
The operational impact extends across multiple attack vectors that leverage Emacs's document processing capabilities. Attackers can deliver malicious font files through email attachments, web browsing via EWW (Emacs Web Wowser), or embedded within documents containing custom faces and formatting specifications. The attack surface broadens as these fonts automatically load during document rendering processes, eliminating the need for user interaction beyond normal document opening procedures. This automatic loading behavior aligns with ATT&CK technique T1203 which describes the exploitation of software vulnerabilities through legitimate application interfaces, making the attack chain particularly stealthy and effective against users who regularly process documents containing embedded font resources.
The memory corruption resulting from this heap overflow can potentially lead to arbitrary code execution within the Emacs process context, depending on exploit conditions and system protections. The vulnerability's exploitation requires careful crafting of font metadata to achieve the precise integer wrap that creates the buffer overflow condition, making it more sophisticated than simple buffer overflows but still highly dangerous in practice. The fix implemented in commit d51a4722316efe0960994d371e1859099894d1ca addresses the core issue by introducing proper overflow checking mechanisms before heap allocation calculations, ensuring that length values from font files are validated against maximum safe allocation limits.
Security practitioners should note that this vulnerability demonstrates the importance of robust input validation in font processing libraries and other binary format parsers. The flaw underscores the necessity of implementing comprehensive integer arithmetic checks when handling untrusted data streams, particularly in applications that process rich media content. Organizations using GNU Emacs for Android should prioritize immediate patch deployment to protect against potential exploitation attempts, while also considering broader defensive measures such as network-based filtering of suspicious font files and user education regarding document attachment risks. The vulnerability serves as a reminder that even seemingly benign application features like font rendering can present significant security risks when proper input validation and memory management practices are not implemented.