CVE-2026-71392: Integer Overflow in GNU Emacs for Android

Published Aug 10, 2026

Updated

GNU Emacs for Android is vulnerable to an integer overflow in the sfntreadcmapformat12() function in src/sfnt.c. When processing a crafted TrueType font file, an unguarded addition in the xmalloc allocation call wraps around on 32-bit builds, causing a heap buffer overflow write. An attacker can deliver a malicious font file via email, EWW (Emacs Web Wowser), or documents with custom faces, causing Emacs to load it. This results in heap memory corruption that can lead to code execution.

This issue was fixed in commit c4e20777c26548722a37b03db93243e83a0d6188

Affected Software

1 affected component

GNU GNU Emacs for Android

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade GNU Emacs for Android to a version that resolves this vulnerability.
Patch commit c4e20777c26548722a37b03db93243e83a0d6188

Event History

Aug 10, 2026

CVE Published

via MITRE·10:22 AM

Data Sourced

via MITRE·10:22 AM

DescriptionWeakness

Data Sourced

via NVD·11:17 AM

DescriptionSeverityWeakness

Frequently Asked Questions

What is the severity of CVE-2026-71392?

The severity of CVE-2026-71392 is rated 74, indicating a high level of risk.

How do I fix CVE-2026-71392?

To fix CVE-2026-71392, update GNU Emacs for Android to the latest version where the vulnerability has been addressed.

What systems are affected by CVE-2026-71392?

CVE-2026-71392 affects GNU Emacs for Android running on 32-bit builds.

What type of vulnerability is CVE-2026-71392?

CVE-2026-71392 is classified as an integer overflow vulnerability that can lead to a buffer overflow.

Can exploiting CVE-2026-71392 lead to remote code execution?

Yes, exploiting CVE-2026-71392 can allow an attacker to perform a heap buffer overflow, potentially leading to remote code execution.