CVE-2026-71393 Overview
CVE-2026-71393 is an integer overflow vulnerability [CWE-190] in GNU Emacs for Android. The flaw resides in the sfnt_read_name_table() function within src/sfnt.c. The function computes an allocation size using a 32-bit length value read from a TrueType font file without validating for overflow. On 32-bit targets, a crafted font causes the calculation to wrap, producing an undersized heap allocation. A subsequent read() writes past the buffer boundary, causing a heap buffer overflow. Attackers can deliver malicious font files through email, EWW (Emacs Web Wowser), or documents with custom faces, leading to heap memory corruption and possible code execution.
Critical Impact
A crafted TrueType font can trigger heap corruption in Emacs on 32-bit Android builds, enabling potential arbitrary code execution within the user's Emacs process.
Affected Products
- GNU Emacs for Android (32-bit builds)
- GNU Emacs versions containing sfnt_read_name_table() prior to commit d51a4722316efe0960994d371e1859099894d1ca
- Any Emacs downstream distribution incorporating the vulnerable src/sfnt.c
Discovery Timeline
- 2026-08-10 - CVE-2026-71393 published to NVD
- 2026-08-10 - Last updated in NVD database
Technical Details for CVE-2026-71393
Vulnerability Analysis
The vulnerability affects Emacs's built-in TrueType font parser used to render custom faces on Android. When Emacs parses the name table of a font, sfnt_read_name_table() in src/sfnt.c reads a 32-bit length field and uses it directly to size a heap allocation. Because the arithmetic performed on this length value is not checked for overflow, a specially crafted value causes the computed allocation size to wrap around a 32-bit boundary. The allocator returns a buffer smaller than the attacker-controlled length. A follow-on read() call then copies attacker-supplied bytes into that undersized buffer, overwriting adjacent heap metadata and objects.
Root Cause
The root cause is missing bounds validation before an allocation size calculation involving untrusted 32-bit input from a font file. On 32-bit Android targets, size_t is 32 bits wide, so the wrap occurs silently and the allocator succeeds with a small buffer while the parser proceeds as if the full requested size was reserved.
Attack Vector
An attacker crafts a TrueType font file containing manipulated name table length fields. The victim triggers parsing by opening an email attachment, visiting a page through EWW, or loading a document that references a custom face. Emacs loads the font, executes the vulnerable parsing path, and the heap is corrupted. User interaction is required, but the source can be remote.
No verified public exploit code exists at the time of publication. Refer to the GNU Emacs commit details and the CERT Poland advisory for technical background.
Detection Methods for CVE-2026-71393
Indicators of Compromise
- Emacs process crashes or SIGABRT events on Android devices immediately after opening emails, EWW pages, or documents containing embedded fonts
- Unexpected heap corruption warnings from libc (malloc_consolidate, tcache messages) tied to the Emacs process
- Presence of untrusted .ttf or .otf files delivered through email or web browsing sessions rendered in Emacs
Detection Strategies
- Inventory Android endpoints running Emacs and identify builds compiled without the sfnt_read_name_table() fix
- Inspect font files loaded by Emacs for anomalous name table length fields that could trigger wraparound arithmetic
- Correlate Emacs process crashes with recent file-open or EWW navigation events in host telemetry
Monitoring Recommendations
- Alert on Emacs process termination signals paired with font-file access on Android hosts
- Monitor mail gateways and web proxies for delivery of TrueType fonts to endpoints running Emacs
- Track Emacs package versions across managed devices and flag installations predating commit d51a4722316efe0960994d371e1859099894d1ca
How to Mitigate CVE-2026-71393
Immediate Actions Required
- Update GNU Emacs on Android to a build that includes commit d51a4722316efe0960994d371e1859099894d1ca
- Restrict Emacs from opening untrusted font files delivered via email or EWW until patched
- Prefer 64-bit Android Emacs builds where feasible, which are not affected by the 32-bit size wrap
Patch Information
The issue is fixed in upstream commit d51a4722316efe0960994d371e1859099894d1ca in the GNU Emacs repository. The patch adds overflow checking to the allocation size computation in sfnt_read_name_table() within src/sfnt.c. Review the GNU Emacs commit details and rebuild or upgrade affected Emacs packages accordingly.
Workarounds
- Disable custom face rendering for untrusted documents by setting inhibit-compacting-font-caches and avoiding user-installed fonts
- Configure EWW to avoid downloading remote font resources when rendering pages
- Filter inbound email attachments with .ttf and .otf extensions at the mail gateway for users running vulnerable Emacs builds
# Configuration example: verify patched Emacs build on Android
emacs --batch --eval "(princ emacs-version)"
# Confirm the source tree contains the fix commit
git -C /path/to/emacs log --oneline | grep d51a4722316efe0960994d371e1859099894d1ca
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
