CVE-2026-71391 Overview
CVE-2026-71391 is an off-by-one error [CWE-193] in the GNU Emacs for Android font parser. The flaw resides in the gvar table parser inside src/sfnt.c. The shared-coordinate index boundary check in sfnt_vary_simple_glyph() and sfnt_vary_compound_glyph() uses a strict greater-than comparison instead of greater-than-or-equal. A crafted TrueType variable font bypasses the check and triggers a heap-based out-of-bounds read through memcpy. Attackers can deliver a malicious font via email, EWW (Emacs Web Wowser), or documents with custom faces, causing Emacs to load it and leak heap memory.
Critical Impact
Leaked heap contents can be used to defeat Address Space Layout Randomization (ASLR), enabling reliable follow-on exploitation.
Affected Products
- GNU Emacs for Android (versions prior to commit 95ab9ef627b212d74d321c5bbb5b56a1be7b9fbe)
- Builds incorporating the src/sfnt.c gvar parser
- Any Emacs distribution shipping the vulnerable sfnt font handling code
Discovery Timeline
- 2026-08-10 - CVE-2026-71391 published to NVD
- 2026-08-10 - Last updated in NVD database
Technical Details for CVE-2026-71391
Vulnerability Analysis
The defect lives in the variable font handling of the sfnt subsystem shipped with Emacs on Android. Variable fonts use the gvar table to describe per-glyph coordinate deltas. The parser reads a shared-coordinate index and validates it against the number of shared tuples before copying data.
Because the validation uses a strict greater-than comparison, an index equal to the array length is accepted as valid. The subsequent memcpy reads one entry past the allocated buffer. The resulting heap-based out-of-bounds read exposes adjacent heap memory to the font consumer.
Root Cause
The root cause is a classic off-by-one boundary check. The condition should reject any index greater than or equal to the number of shared coordinates, but the code only rejects strictly greater values. This single-character comparison error transforms a valid-looking index into an out-of-bounds access. Fonts are attacker-controlled input in many workflows, so the parser must treat them as untrusted.
Attack Vector
Exploitation requires the victim to open or render attacker-supplied content. Delivery paths include email attachments processed by Emacs, HTML pages rendered by EWW that reference remote fonts, and text files that specify custom faces backed by malicious TrueType variable fonts. User interaction is required to load the affected content. The leaked heap data can reveal library base addresses and heap pointers, defeating ASLR and enabling chained exploitation with other memory-corruption bugs.
No verified public exploit code is available. See the CERT CVE-2026-71391 Advisory and the GNU Emacs Commit Log for technical details.
Detection Methods for CVE-2026-71391
Indicators of Compromise
- Emacs process crashes or sanitizer alerts triggered while rendering .ttf or .otf variable font files
- Unexpected TrueType variable font attachments delivered through email or downloaded via EWW
- Documents referencing custom faces backed by fonts sourced from untrusted domains
Detection Strategies
- Hunt for Emacs sessions loading fonts from user-writable or network-sourced locations rather than system font directories
- Inspect font files for malformed gvar tables with shared-coordinate indices equal to the shared tuple count
- Correlate Emacs process telemetry with subsequent memory-disclosure or exploitation attempts on the same host
Monitoring Recommendations
- Monitor file access from Emacs to font paths outside standard system directories
- Track outbound EWW requests fetching remote font resources on Android endpoints
- Enable heap sanitizer or AddressSanitizer builds in development and QA environments to catch out-of-bounds reads early
How to Mitigate CVE-2026-71391
Immediate Actions Required
- Update GNU Emacs to a build that includes commit 95ab9ef627b212d74d321c5bbb5b56a1be7b9fbe or later
- Restrict Emacs from loading fonts from untrusted directories or remote sources until the patch is applied
- Advise users to avoid opening unsolicited font attachments and to disable automatic font loading in EWW
Patch Information
The issue is fixed upstream in commit 95ab9ef627b212d74d321c5bbb5b56a1be7b9fbe. The patch replaces the strict greater-than comparison with a greater-than-or-equal check, rejecting indices that would otherwise trigger the out-of-bounds memcpy. Rebuild Emacs from source at or after this commit, or install a distribution package that incorporates the fix. Refer to the GNU Emacs Commit Log for the exact diff.
Workarounds
- Configure Emacs to disable variable font handling where feasible until patched builds are deployed
- Sandbox Emacs on Android using platform isolation to limit the impact of information disclosure
- Block delivery of TrueType and OpenType font attachments at the mail gateway for high-risk user groups
# Verify Emacs source includes the fix commit
cd /path/to/emacs
git log --oneline | grep 95ab9ef627b212d74d321c5bbb5b56a1be7b9fbe
# Rebuild after pulling the fix
git pull origin master
./autogen.sh && ./configure && make && sudo make install
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
