CVE-2026-71393

Name	CVE-2026-71393
Description	GNU Emacs for Android is vulnerable to an integer overflow in sfnt_read_name_table() in src/sfnt.c. The function computes an allocation size using a 32-bit length value from a TrueType font file without overflow checking. On 32-bit targets, a crafted font causes the calculation to wrap, resulting in an undersized heap allocation. A subsequent read() call writes beyond the buffer, causing a heap buffer overflow. An attacker can deliver a malicious font file via email, EWW (Emacs Web Wowser), or documents with custom faces, causing Emacs to load it. This can lead to heap memory corruption and potential code execution. This issue was fixed in commit d51a4722316efe0960994d371e1859099894d1ca
Source	CVE (at NVD; CERT, ENISA, LWN, oss-sec, fulldisc, Debian ELTS, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)

Vulnerable and fixed packages

The table below lists information on source packages.

Source Package	Release	Version	Status
emacs (PTS)	bullseye	1:27.1+1-3.1+deb11u5	fixed
	bullseye (security)	1:27.1+1-3.1+deb11u6	fixed
	bookworm, bookworm (security)	1:28.2+1-15+deb12u4	fixed
	trixie	1:30.1+1-6	fixed
	trixie (security)	1:30.1+1-6+deb13u1	fixed
	forky, sid	1:30.2+1-11	fixed

The information below is based on the following data on fixed versions.

Package	Type	Release	Fixed Version	Urgency	Origin	Debian Bugs
emacs	source	(unstable)	(not affected)

Notes

- emacs <not-affected> (Only affects builds for Android, SFNT not enabled)
https://cert.pl/en/posts/2026/08/CVE-2026-71391/
Fixed by: https://cgit.git.savannah.gnu.org/cgit/emacs.git/commit/?id=d51a4722316efe0960994d371e1859099894d1ca