CVE-2026-71391

Name	CVE-2026-71391
Description	GNU Emacs for Android contains an off-by-one error in the gvar table parser in src/sfnt.c. The shared-coordinate index boundary check in sfnt_vary_simple_glyph() and sfnt_vary_compound_glyph() uses a strict greater-than comparison instead of greater-than-or-equal, allowing a crafted TrueType variable font to bypass the check and trigger a heap-based out-of-bounds read via memcpy. An attacker can deliver a malicious font file via email, EWW (Emacs Web Wowser), or documents with custom faces, causing Emacs to load it. This exposes heap memory contents which can be later used to defeat ASLR. This issue was fixed in commit 95ab9ef627b212d74d321c5bbb5b56a1be7b9fbe
Source	CVE (at NVD; CERT, ENISA, LWN, oss-sec, fulldisc, Debian ELTS, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)

Vulnerable and fixed packages

The table below lists information on source packages.

Source Package	Release	Version	Status
emacs (PTS)	bullseye	1:27.1+1-3.1+deb11u5	fixed
	bullseye (security)	1:27.1+1-3.1+deb11u6	fixed
	bookworm, bookworm (security)	1:28.2+1-15+deb12u4	fixed
	trixie	1:30.1+1-6	fixed
	trixie (security)	1:30.1+1-6+deb13u1	fixed
	forky, sid	1:30.2+1-11	fixed

The information below is based on the following data on fixed versions.

Package	Type	Release	Fixed Version	Urgency	Origin	Debian Bugs
emacs	source	(unstable)	(not affected)

Notes

- emacs <not-affected> (Only affects builds for Android, SFNT not enabled)
https://cert.pl/en/posts/2026/08/CVE-2026-71391/
Fixed by: https://cgit.git.savannah.gnu.org/cgit/emacs.git/commit/?id=95ab9ef627b212d74d321c5bbb5b56a1be7b9fbe