CVE-2026-71393 Heap Buffer Overflow in GNU Emacs for Android
An integer overflow in GNU Emacs for Android allows attackers to execute arbitrary code via a crafted font file delivered through email or web browsing.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- None listed
What is CVE-2026-71393?
CVE-2026-71393 is a medium-severity vulnerability in GNU Emacs, published on 10 Aug 2026. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
GNU Emacs for Android is vulnerable to an integer overflow in sfnt_read_name_table() in src/sfnt.c. The function computes an allocation size using a 32-bit length value from a TrueType font file without overflow checking. On 32-bit targets, a crafted font causes the calculation to wrap, resulting in an undersized heap allocation. A subsequent read() call writes beyond the buffer, causing a heap buffer overflow. An attacker can deliver a malicious font file via email, EWW (Emacs Web Wowser), or documents with custom faces, causing Emacs to load it. This can lead to heap memory corruption and potential code execution.
This issue was fixed in commit d51a4722316efe0960994d371e1859099894d1ca
Weakness: CWE-190
Which versions are affected by CVE-2026-71393?
How do I fix CVE-2026-71393?
No fix has been published for CVE-2026-71393 yet. Limit exposure of the affected software until one is available.
Is CVE-2026-71393 being exploited?
There is no known exploitation of CVE-2026-71393 in the wild and no public exploit code.
Sources
Also known as GHSA-4rgf-7285-chf8, UBUNTU-CVE-2026-71393.