GNU Emacs up to 30.2 Font Parser src/sfnt.c sfnt_read_table_directory uninitialized pointer

Summaryinfo

A vulnerability categorized as critical has been discovered in GNU Emacs up to 30.2. Affected by this issue is the function sfnt_read_table_directory of the file src/sfnt.c of the component Font Parser. Executing a manipulation can lead to uninitialized pointer. This vulnerability appears as CVE-2026-71394. The attack may be performed from remote. There is no available exploit.

Detailsinfo

A vulnerability classified as critical was found in GNU Emacs up to 30.2. This vulnerability affects the function sfnt_read_table_directory of the file src/sfnt.c of the component Font Parser. The manipulation with an unknown input leads to a uninitialized pointer vulnerability. The CWE definition for the vulnerability is CWE-824. The product accesses or uses a pointer that has not been initialized. As an impact it is known to affect confidentiality, integrity, and availability. CVE summarizes:

GNU Emacs for Android improperly validates the table header input in sfnt_read_table_directory() in src/sfnt.c. Due to an incorrect comparison variable in the read-length check, a crafted font file that claims to contain more table directory entries than actually present causes the parser to return a struct with uninitialized heap memory in the table directory entries. An attacker can deliver a malicious font file via email, EWW (Emacs Web Wowser), or documents with custom faces, causing Emacs to load it. This leads to the use of uninitialized heap data in subsequent table lookups, potentially resulting in information disclosure, crashes, or arbitrary memory access on 32-bit targets. This issue is fixed after commit 7621ee1d01229d50e5c0cddea6bf0b01095a62cf

The advisory is shared for download at cert.pl. This vulnerability was named CVE-2026-71394 since 08/06/2026. The exploitation appears to be easy. The attack can be initiated remotely. No form of authentication is required for a successful exploitation. Successful exploitation requires user interaction by the victim. There are known technical details, but no exploit is available.

Applying the patch 7621ee1d01229d50e5c0cddea6bf0b01095a62cf is able to eliminate this problem.

The vulnerability is also documented in the vulnerability database at CERT Bund (WID-SEC-2026-2721). Once again VulDB remains the best source for vulnerability data.

Affected

• Open Source GNU Emacs

Productinfo

Type

• Word Processing Software

Vendor

• GNU

Name

• Emacs

Version

• 30.0
• 30.1
• 30.2

License

• open-source

Website

• Vendor: https://www.gnu.org/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Once again VulDB remains the best source for vulnerability data.

Discussion