Skip to main content

GNU Emacs Android CVE-2026-71394

| EUVDEUVD-2026-55257 MEDIUM
Improper Validation of Specified Quantity in Input (CWE-1284)
2026-08-10 CERT-PL GHSA-jx5g-mm7r-35gq
Google Information Disclosure Emacs Red Hat Suse
5.3
CVSS 4.0 · Vendor: CERT-PL
Share

Severity by source

Vendor (CERT-PL) PRIMARY
5.3 MEDIUM
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:L/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
vuln.today AI
6.3 MEDIUM

Network delivery with no auth needed, but user must open content; C:L and I:L reflect heap disclosure and limited memory access (I:L capped given 32-bit constraint).

3.1 AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L
4.0 AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:L/SC:L/SI:L/SA:N
SUSE
6.6 MEDIUM
AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:H
Red Hat
5.3 MEDIUM
qualitative

Primary rating from Vendor (CERT-PL).

CVSS VectorVendor: CERT-PL

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:L/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
P
Scope
X

Lifecycle Timeline

2
Analysis Generated
Aug 10, 2026 - 11:06 vuln.today
CVE Published
Aug 10, 2026 - 10:23 cve.org
MEDIUM 5.3

DescriptionCVE.org

GNU Emacs for Android improperly validates the table header input in sfnt_read_table_directory() in src/sfnt.c. Due to an incorrect comparison variable in the read-length check, a crafted font file that claims to contain more table directory entries than actually present causes the parser to return a struct with uninitialized heap memory in the table directory entries. An attacker can deliver a malicious font file via email, EWW (Emacs Web Wowser), or documents with custom faces, causing Emacs to load it. This leads to the use of uninitialized heap data in subsequent table lookups, potentially resulting in information disclosure, crashes, or arbitrary memory access on 32-bit targets.

This issue is fixed after commit 7621ee1d01229d50e5c0cddea6bf0b01095a62cf

AnalysisAI

Uninitialized heap memory exposure in GNU Emacs for Android's sfnt font parser allows a remote, unauthenticated attacker to trigger information disclosure, process crashes, or arbitrary memory access on 32-bit targets by delivering a crafted font file. The flaw in sfnt_read_table_directory() (src/sfnt.c) stems from an incorrect comparison variable in the read-length check, causing the parser to trust an attacker-controlled table-entry count without proper bounds validation. …

Unlock full vulnerability intelligence

  • Risk assessment & exploitation conditions
  • Attack chain visualization
  • Remediation with exact patch versions
  • Threat intelligence from 22 sources
  • Personal watchlist & email alerts
Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access
Craft font file with inflated table directory count
Delivery
Deliver via email, EWW page, or document with custom face
Exploit
User opens content in Emacs Android
Execution
sfnt_read_table_directory() returns struct with uninitialized heap entries
Persist
Subsequent table lookups consume poisoned data
Impact
Information disclosure or crash (32-bit: arbitrary memory access)
Sign in to reveal

Vulnerability AssessmentAI

Exploitation The attacker must deliver a crafted sfnt/OpenType/TrueType font file through one of the following channels: (1) an email opened and rendered inside GNU Emacs on Android, (2) a webpage loaded via EWW (Emacs Web Wowser) that references the malicious font, or (3) a document or configuration file with a custom font face pointing to the crafted font. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment The CVSS 4.0 score of 5.3 (Medium) reflects the mandatory user interaction (UI:P) and the constrained direct impact on the vulnerable system (VC:N/VI:N/VA:L), with limited subsequent-system confidentiality and integrity risk (SC:L/SI:L). … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario An attacker crafts a malformed OpenType font file in which the table directory header claims a larger entry count than the file actually contains, then embeds this font in an HTML email viewed in Emacs, a webpage served to an EWW user, or a document with a custom face definition. When the Emacs for Android user opens the content, sfnt_read_table_directory() processes the inflated count, returns a struct populated with uninitialized heap memory in the excess entries, and subsequent font table lookups operate on that attacker-influenced data - leaking heap contents on most targets, or enabling memory corruption on 32-bit devices. …
Remediation The primary fix is to update GNU Emacs for Android to a build that includes commit 7621ee1d01229d50e5c0cddea6bf0b01095a62cf; no specific tagged release version containing this commit has been independently confirmed, so users should verify their build date or commit hash against the upstream repository at the GNU Emacs project page (https://www.gnu.org/savannah-checkouts/gnu/emacs/emacs.html). … Detailed patch versions, workarounds, and compensating controls in full report.
Sign in to read full assessment

Threat intelligence, references, and detailed analysis are available after sign-in.

More in Emacs

View all
CVE-2012-0035 CRITICAL
9.3 Jan 19

Untrusted search path vulnerability in EDE in CEDET before 1.0.1, as used in GNU Emacs before 23.4 and other products, a
CVE-2024-39331 CRITICAL
9.8 Jun 23

In Emacs before 29.4, org-link-expand-abbrev in lisp/ol.el expands a %(...) link abbrev even when it specifies an unsafe
CVE-2017-14482 HIGH
8.8 Sep 14

GNU Emacs before 25.3 allows remote attackers to execute arbitrary code via email with crafted "Content-Type: text/enric
CVE-2024-53920 HIGH
7.8 Nov 27

In elisp-mode.el in GNU Emacs before 30.1, a user who chooses to invoke elisp-completion-at-point (for code completion)

CVE-2024-30202 HIGH
7.8 Mar 25

In Emacs before 29.3, arbitrary Lisp code is evaluated as part of turning on Org mode. Rated high severity (CVSS 7.8), t
CVE-2023-2491 HIGH
7.8 May 17

A flaw was found in the Emacs text editor. Rated high severity (CVSS 7.8), this vulnerability is low attack complexity.

CVE-2023-27986 HIGH
7.8 Mar 09

emacsclient-mail.desktop in Emacs 28.1 through 28.2 is vulnerable to Emacs Lisp code injections through a crafted mailto
CVE-2023-27985 HIGH
7.8 Mar 09

emacsclient-mail.desktop in Emacs 28.1 through 28.2 is vulnerable to shell command injections through a crafted mailto:

CVE-2022-45939 HIGH
7.8 Nov 28

GNU Emacs through 28.2 allows attackers to execute commands via shell metacharacters in the name of a source-code file,

CVE-2014-9483 HIGH
7.5 Aug 28

Emacs 24.4 allows remote attackers to bypass security restrictions. Rated high severity (CVSS 7.5), this vulnerability i
CVE-2012-3479 MEDIUM
6.8 Aug 25

lisp/files.el in Emacs 23.2, 23.3, 23.4, and 24.1 automatically executes eval forms in local-variable sections when the

CVE-2024-30205 HIGH
7.1 Mar 25

In Emacs before 29.3, Org mode considers contents of remote files to be trusted. Rated high severity (CVSS 7.1), this vu

Same weakness CWE-1284 – Improper Validation of Specified Quantity in Input

View all
CVE-2025-9316 MEDIUM POC
6.9
CVE-2026-49777 CRITICAL POC
10.0
CVE-2022-37134 CRITICAL POC
9.8
CVE-2021-43267 CRITICAL POC
9.8
CVE-2025-65548 CRITICAL POC
9.1
CVE-2023-54337 CRITICAL POC
9.1
CVE-2025-5349 HIGH POC
8.8
CVE-2026-55706 HIGH POC
8.3

Same technique Information Disclosure

View all
CVE-2019-2725 CRITICAL POC
9.8
CVE-2021-34523 CRITICAL POC
9.0
CVE-2013-2251 CRITICAL POC
9.8
CVE-2017-5638 CRITICAL POC
9.8
CVE-2025-24813 CRITICAL POC
9.8
CVE-2015-1701 HIGH POC
7.8
CVE-2017-0147 HIGH POC
7.5
CVE-2014-6324 HIGH POC
8.8

Vendor StatusVendor

SUSE

Severity: Moderate
Product Status
SUSE Linux Enterprise Desktop 15 SP7 Not-Affected
SUSE Linux Enterprise High Performance Computing 12 Not-Affected
SUSE Linux Enterprise High Performance Computing 15 SP7 Not-Affected
SUSE Linux Enterprise Module for Basesystem 15 SP7 Not-Affected
SUSE Linux Enterprise Module for Desktop Applications 15 SP7 Not-Affected

Share

CVE-2026-71394 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy