CVE-2026-71392

Name	CVE-2026-71392
Description	GNU Emacs for Android is vulnerable to an integer overflow in the sfnt_read_cmap_format_12() function in src/sfnt.c. When processing a crafted TrueType font file, an unguarded addition in the xmalloc allocation call wraps around on 32-bit builds, causing a heap buffer overflow write. An attacker can deliver a malicious font file via email, EWW (Emacs Web Wowser), or documents with custom faces, causing Emacs to load it. This results in heap memory corruption that can lead to code execution. This issue was fixed in commit c4e20777c26548722a37b03db93243e83a0d6188
Source	CVE (at NVD; CERT, ENISA, LWN, oss-sec, fulldisc, Debian ELTS, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)

Vulnerable and fixed packages

The table below lists information on source packages.

Source Package	Release	Version	Status
emacs (PTS)	bullseye	1:27.1+1-3.1+deb11u5	fixed
	bullseye (security)	1:27.1+1-3.1+deb11u6	fixed
	bookworm, bookworm (security)	1:28.2+1-15+deb12u4	fixed
	trixie	1:30.1+1-6	fixed
	trixie (security)	1:30.1+1-6+deb13u1	fixed
	forky, sid	1:30.2+1-11	fixed

The information below is based on the following data on fixed versions.

Package	Type	Release	Fixed Version	Urgency	Origin	Debian Bugs
emacs	source	(unstable)	(not affected)

Notes

- emacs <not-affected> (Only affects builds for Android, SFNT not enabled)
https://cert.pl/en/posts/2026/08/CVE-2026-71391/
Fixed by: https://cgit.git.savannah.gnu.org/cgit/emacs.git/commit/?id=c4e20777c26548722a37b03db93243e83a0d6188