CVE-2026-71394

Name	CVE-2026-71394
Description	GNU Emacs for Android improperly validates the table header input in sfnt_read_table_directory() in src/sfnt.c. Due to an incorrect comparison variable in the read-length check, a crafted font file that claims to contain more table directory entries than actually present causes the parser to return a struct with uninitialized heap memory in the table directory entries. An attacker can deliver a malicious font file via email, EWW (Emacs Web Wowser), or documents with custom faces, causing Emacs to load it. This leads to the use of uninitialized heap data in subsequent table lookups, potentially resulting in information disclosure, crashes, or arbitrary memory access on 32-bit targets. This issue is fixed after commit 7621ee1d01229d50e5c0cddea6bf0b01095a62cf
Source	CVE (at NVD; CERT, ENISA, LWN, oss-sec, fulldisc, Debian ELTS, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)

Vulnerable and fixed packages

The table below lists information on source packages.

Source Package	Release	Version	Status
emacs (PTS)	bullseye	1:27.1+1-3.1+deb11u5	fixed
	bullseye (security)	1:27.1+1-3.1+deb11u6	fixed
	bookworm, bookworm (security)	1:28.2+1-15+deb12u4	fixed
	trixie	1:30.1+1-6	fixed
	trixie (security)	1:30.1+1-6+deb13u1	fixed
	forky, sid	1:30.2+1-11	fixed

The information below is based on the following data on fixed versions.

Package	Type	Release	Fixed Version	Urgency	Origin	Debian Bugs
emacs	source	(unstable)	(not affected)

Notes

- emacs <not-affected> (Only affects builds for Android, SFNT not enabled)
https://cert.pl/en/posts/2026/08/CVE-2026-71391
Fixed by: https://cgit.git.savannah.gnu.org/cgit/emacs.git/commit/?id=7621ee1d01229d50e5c0cddea6bf0b01095a62cf