CVE-2026-71391: Off-by-One Error in GNU Emacs for Android
GNU Emacs for Android contains an off-by-one error in the gvar table parser in src/sfnt.c. The shared-coordinate index boundary check in sfntvarysimpleglyph() and sfntvarycompoundglyph() uses a strict greater-than comparison instead of greater-than-or-equal, allowing a crafted TrueType variable font to bypass the check and trigger a heap-based out-of-bounds read via memcpy. An attacker can deliver a malicious font file via email, EWW (Emacs Web Wowser), or documents with custom faces, causing Emacs to load it. This exposes heap memory contents which can be later used to defeat ASLR.
This issue was fixed in commit 95ab9ef627b212d74d321c5bbb5b56a1be7b9fbe
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
GNU Emacs for Androidto a version that resolves this vulnerability.Patch 95ab9ef627b212d74d321c5bbb5b56a1be7b9fbe
Event History
Frequently Asked Questions
What is the severity of CVE-2026-71391?
The severity of CVE-2026-71391 is rated as 43, indicating a moderate risk level.
How do I fix CVE-2026-71391?
To fix CVE-2026-71391, update your GNU Emacs for Android to the latest version where the off-by-one error is resolved.
What vulnerabilities are associated with CVE-2026-71391?
CVE-2026-71391 is associated with an off-by-one error affecting the gvar table parser in GNU Emacs for Android.
What systems are affected by CVE-2026-71391?
CVE-2026-71391 specifically affects GNU Emacs for Android.
How does CVE-2026-71391 impact users?
CVE-2026-71391 can allow crafted TrueType variable fonts to exploit the off-by-one error leading to potential data corruption.