CVE-2026-71392: GNU Emacs Buffer Overflow Vulnerability

CVE-2026-71392 Overview

CVE-2026-71392 is an integer overflow vulnerability in GNU Emacs for Android affecting the sfnt_read_cmap_format_12() function in src/sfnt.c. When Emacs parses a crafted TrueType font file, an unguarded addition inside an xmalloc allocation call wraps around on 32-bit builds. The undersized allocation leads to a heap buffer overflow write during subsequent cmap processing.

An attacker can deliver a malicious font through email, the Emacs Web Wowser (EWW) browser, or documents that reference custom faces. Opening the content triggers font loading and heap memory corruption, which can enable arbitrary code execution. The issue is tracked under [CWE-190] and was fixed in commit c4e20777c26548722a37b03db93243e83a0d6188.

Critical Impact
Heap corruption from a crafted TrueType font can lead to code execution in the Emacs process on 32-bit Android builds.

Affected Products

GNU Emacs for Android (32-bit builds)
Versions prior to commit c4e20777c26548722a37b03db93243e83a0d6188
Emacs components using src/sfnt.c cmap format 12 parsing

Discovery Timeline

2026-08-10 - CVE-2026-71392 published to NVD
2026-08-10 - Last updated in NVD database
Fix commit - c4e20777c26548722a37b03db93243e83a0d6188 merged into GNU Emacs

Technical Details for CVE-2026-71392

Vulnerability Analysis

The defect lives in sfnt_read_cmap_format_12(), the parser responsible for reading TrueType cmap subtable format 12. Format 12 subtables describe segmented coverage of Unicode code points using an array of groups, each defined by a start character, end character, and start glyph ID.

The parser computes the size of a buffer using an addition operation that combines an attacker-controlled group count with a fixed offset. On 32-bit builds, the multiplication and addition producing the byte size can exceed the size_t range and wrap to a small value. The wrapped value is passed to xmalloc, which returns a heap allocation far smaller than the parser expects.

Subsequent read loops write attacker-supplied cmap group data into this undersized buffer, corrupting adjacent heap metadata and allocator chunks. Because Emacs on Android often processes fonts automatically when rendering messages or documents, exploitation requires only that the user open the containing content.

Root Cause

The root cause is missing overflow validation before allocation, matching [CWE-190] Integer Overflow or Wraparound. The size computation trusts field values parsed directly from the font file without bounds checking against SIZE_MAX. A checked arithmetic helper or width-widened intermediate would have prevented the wraparound.

Attack Vector

Delivery paths include font attachments in email, remote fonts fetched by EWW while rendering HTML, and Org or LaTeX documents that declare custom faces backed by attacker-supplied font files. User interaction is required to open the content, but no privileges or authentication are needed. See the CERT Security Advisory and the GNU Emacs Commit Update for technical detail on the fix. No verified public exploit code is available at this time.

Detection Methods for CVE-2026-71392

Indicators of Compromise

Unexpected crashes or SIGSEGV signals from the Emacs process on Android shortly after opening email, web pages, or documents
TrueType or OpenType font files with abnormally large cmap format 12 numGroups field values
Emacs child process spawning shells or performing network activity after font rendering

Detection Strategies

Inspect fonts referenced by incoming mail and web content for malformed cmap subtables using tools such as fonttools or ttx
Monitor Emacs process telemetry for heap corruption signatures, abort signals, and abnormal memory growth during font loading
Correlate EWW browsing events and MIME attachment opens with subsequent process anomalies

Monitoring Recommendations

Log Emacs version and build architecture across managed Android devices to identify 32-bit installations
Alert on Emacs processes that terminate abnormally within seconds of network-fetched resource loading
Track outbound connections initiated by Emacs immediately after document rendering

How to Mitigate CVE-2026-71392

Immediate Actions Required

Update GNU Emacs for Android to a build that includes commit c4e20777c26548722a37b03db93243e83a0d6188 or later
Prefer 64-bit Emacs builds where available, as the wraparound is specific to 32-bit size_t arithmetic
Restrict Emacs from opening untrusted font attachments and remote resources until patched

Patch Information

The upstream fix is available in the GNU Emacs repository as commit c4e20777c26548722a37b03db93243e83a0d6188. Rebuild Emacs for Android from a source tree containing this commit, or install a downstream package that incorporates it. Refer to the GNU Emacs Source Overview for build instructions.

Workarounds

Disable automatic font loading in EWW by setting shr-use-fonts to nil
Avoid opening TrueType or OpenType attachments from untrusted senders in Gnus or MH-E
Configure Emacs faces to reference only system-installed fonts rather than file paths supplied by documents

bash

# Configuration example: reduce exposure by disabling remote font rendering in EWW
# Add to ~/.emacs.d/init.el
(setq shr-use-fonts nil)
(setq shr-inhibit-images t)
(setq mm-inhibit-file-name-handlers '(image-file-handler))