CVE-2026-71394 Overview
CVE-2026-71394 affects GNU Emacs for Android, where the sfnt_read_table_directory() function in src/sfnt.c fails to properly validate table header input when parsing font files. A crafted font file that declares more table directory entries than are actually present causes the parser to return a struct containing uninitialized heap memory. Attackers can deliver malicious font files through email, EWW (Emacs Web Wowser), or documents with custom faces, prompting Emacs to load them. Subsequent table lookups consume the uninitialized heap data, leading to information disclosure, crashes, or arbitrary memory access on 32-bit targets. The weakness is classified under [CWE-1284] (Improper Validation of Specified Quantity in Input).
Critical Impact
Loading a malicious font file in Emacs for Android can leak heap memory contents, crash the editor, or enable arbitrary memory access on 32-bit devices.
Affected Products
- GNU Emacs for Android (versions prior to commit 7621ee1d01229d50e5c0cddea6bf0b01095a62cf)
- Emacs Web Wowser (EWW) rendering pipeline that processes remote fonts
- Documents opened in Emacs that reference custom font faces
Discovery Timeline
- 2026-08-10 - CVE-2026-71394 published to NVD
- 2026-08-10 - Last updated in NVD database
Technical Details for CVE-2026-71394
Vulnerability Analysis
The vulnerability resides in the SFNT (Spline Font) table directory parser used by Emacs to read TrueType and OpenType font resources. The parser reads a declared table count from the font header and allocates a directory structure sized according to that count. Because of an incorrect comparison variable in the read-length check, the parser accepts a declared count that exceeds the bytes actually available in the file. Rather than failing safely, sfnt_read_table_directory() returns a directory struct whose trailing entries contain uninitialized heap memory. Downstream code paths in Emacs subsequently treat those uninitialized bytes as valid table offsets and lengths, dereferencing pointers derived from stale heap contents.
Root Cause
The defect is an input validation flaw [CWE-1284]. The read-length check compares against the wrong variable, so the guard that should reject truncated or oversized directory declarations never triggers. The function proceeds to populate only the entries that fit within the actual read, while the remaining slots in the returned struct retain whatever data occupied that heap region prior to allocation.
Attack Vector
Exploitation requires the victim to render a crafted font. Delivery channels include HTML email with embedded font references, web pages loaded through EWW, and documents that specify custom faces backed by attacker-supplied font files. User interaction is required to open the content. On 32-bit Android builds, pointer arithmetic against uninitialized offsets can direct reads or writes to attacker-influenced addresses. On 64-bit builds the practical outcome is typically information disclosure or a crash.
No verified proof-of-concept code has been published. Technical details are described in the CERT Poland CVE Analysis and the GNU Emacs Project Page.
Detection Methods for CVE-2026-71394
Indicators of Compromise
- Unexpected Emacs process crashes on Android devices shortly after opening email, browsing with EWW, or loading documents with custom faces.
- Font files with SFNT headers where the declared numTables value is inconsistent with the file size.
- Delivery of .ttf, .otf, or embedded font resources from untrusted senders or web origins.
Detection Strategies
- Inspect font files transiting mail and web gateways for malformed SFNT table directory headers, flagging declared table counts that exceed available bytes.
- Correlate Emacs crash telemetry on Android endpoints with recent EWW browsing or attachment activity to surface likely triggers.
- Track installations of Emacs for Android and compare against the fixed commit 7621ee1d01229d50e5c0cddea6bf0b01095a62cf to identify vulnerable builds.
Monitoring Recommendations
- Enable crash log collection on Android endpoints running Emacs and forward tombstones to a central analytics platform.
- Alert on repeated segmentation faults in Emacs processes across multiple users, which may indicate a targeted campaign.
- Monitor mail security telemetry for attachments containing font files from external senders.
How to Mitigate CVE-2026-71394
Immediate Actions Required
- Update GNU Emacs for Android to a build that includes commit 7621ee1d01229d50e5c0cddea6bf0b01095a62cf or later.
- Advise users to avoid opening font attachments and untrusted web content in EWW until patched builds are deployed.
- Restrict Emacs on Android to trusted document sources where feasible, particularly on 32-bit devices.
Patch Information
The issue is fixed after upstream commit 7621ee1d01229d50e5c0cddea6bf0b01095a62cf in the GNU Emacs source tree. Rebuild Android packages from a source tree containing this commit, or install a distribution package that incorporates the fix. Refer to the GNU Emacs Project Page for release information.
Workarounds
- Disable custom face rendering for untrusted documents by configuring Emacs to ignore embedded font references.
- Block inbound email attachments with .ttf and .otf extensions from external senders at the mail gateway.
- Avoid using EWW to browse untrusted origins on Android until the patched build is installed.
# Verify the installed Emacs source includes the fix commit
cd /path/to/emacs-source
git log --oneline 7621ee1d01229d50e5c0cddea6bf0b01095a62cf -1
# Rebuild after confirming the commit is present
./autogen.sh && ./configure --with-android && make
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
