Skip to main content

GNU Emacs EUVDEUVD-2026-55259

| CVE-2026-71392 MEDIUM
Integer Overflow or Wraparound (CWE-190)
2026-08-10 CERT-PL GHSA-39p3-jw8m-jmr7
RCE Buffer Overflow Google Integer Overflow Emacs Gnu
5.3
CVSS 4.0 · Vendor: CERT-PL
Share

Severity by source

Vendor (CERT-PL) PRIMARY
5.3 MEDIUM
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:L/SC:N/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
vuln.today AI
8.8 HIGH

Network delivery via email or EWW, no privileges required, user must open content; potential full-process code execution warrants C:H/I:H/A:H despite unconfirmed RCE chain.

3.1 AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
4.0 AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
SUSE
7.8 HIGH
AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Red Hat
7.8 MEDIUM
qualitative

Primary rating from Vendor (CERT-PL).

CVSS VectorVendor: CERT-PL

Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
P
Scope
X

Lifecycle Timeline

2
Analysis Generated
Aug 10, 2026 - 11:06 vuln.today
CVE Published
Aug 10, 2026 - 10:22 cve.org
MEDIUM 5.3

DescriptionCVE.org

GNU Emacs for Android is vulnerable to an integer overflow in the sfnt_read_cmap_format_12() function in src/sfnt.c. When processing a crafted TrueType font file, an unguarded addition in the xmalloc allocation call wraps around on 32-bit builds, causing a heap buffer overflow write. An attacker can deliver a malicious font file via email, EWW (Emacs Web Wowser), or documents with custom faces, causing Emacs to load it. This results in heap memory corruption that can lead to code execution.

This issue was fixed in commit c4e20777c26548722a37b03db93243e83a0d6188

AnalysisAI

Heap buffer overflow via integer wraparound in GNU Emacs for Android's TrueType font parser allows an attacker to corrupt heap memory and potentially achieve code execution by delivering a crafted font file through email, the built-in EWW browser, or documents using custom typefaces. The flaw is confined to 32-bit builds where an unguarded addition in sfnt_read_cmap_format_12() wraps around when computing an xmalloc allocation size, producing a fatally undersized heap buffer. No public exploit has been identified at time of analysis and this vulnerability is not listed in CISA KEV; however, CERT-PL reported the issue and an upstream patch commit is available.

Technical ContextAI

The vulnerability originates in src/sfnt.c within the sfnt font-rendering subsystem - specifically in sfnt_read_cmap_format_12(), which parses the Unicode BMP and full-repertoire character map subtable (platform/encoding format 12) embedded in TrueType and OpenType font files. CWE-190 (Integer Overflow or Wraparound) is the root cause: on 32-bit Emacs for Android builds, a summation used to compute the byte length of the glyph map structure overflows the 32-bit signed or unsigned integer boundary and wraps to a small value before being passed to xmalloc, Emacs's allocator wrapper. The resulting heap region is far smaller than the data subsequently written into it, producing a classic out-of-bounds heap write (heap buffer overflow). The CPE string cpe:2.3:a:gnu:emacs:*:*:*:*:*:*:*:* covers the full GNU Emacs codebase tree; the exploitable condition is specific to 32-bit pointer-width builds because 64-bit targets use wider arithmetic types that prevent the wrap. Desktop and server Emacs builds on 64-bit Linux, Windows, and macOS are therefore not exposed through this particular code path.

RemediationAI

The primary remediation is to apply the upstream fix commit c4e20777c26548722a37b03db93243e83a0d6188, available at https://git.savannah.gnu.org/cgit/emacs.git/commit/?id=c4e20777c26548722a37b03db93243e83a0d6188. No specific tagged release version incorporating this commit has been independently confirmed - users relying on distribution packages (F-Droid, vendor APKs) should monitor those channels for updated 32-bit builds rather than assuming a versioned fix is available. As a compensating control pending a patched build, users on 32-bit Emacs for Android should avoid opening emails with rich typographic content, browsing untrusted sites via EWW, or loading documents that specify custom typefaces from untrusted sources; the trade-off is reduced usability of core Emacs mail and browsing features. Migrating to a 64-bit Emacs for Android build, where available, eliminates the integer-width condition entirely. Restricting custom-face definitions to trusted sources via Emacs configuration (e.g., safe-local-variable-values) may limit the document-delivery vector but does not address email or EWW pathways.

More in Emacs

View all
CVE-2012-0035 CRITICAL
9.3 Jan 19

Untrusted search path vulnerability in EDE in CEDET before 1.0.1, as used in GNU Emacs before 23.4 and other products, a
CVE-2024-39331 CRITICAL
9.8 Jun 23

In Emacs before 29.4, org-link-expand-abbrev in lisp/ol.el expands a %(...) link abbrev even when it specifies an unsafe
CVE-2017-14482 HIGH
8.8 Sep 14

GNU Emacs before 25.3 allows remote attackers to execute arbitrary code via email with crafted "Content-Type: text/enric
CVE-2024-53920 HIGH
7.8 Nov 27

In elisp-mode.el in GNU Emacs before 30.1, a user who chooses to invoke elisp-completion-at-point (for code completion)

CVE-2024-30202 HIGH
7.8 Mar 25

In Emacs before 29.3, arbitrary Lisp code is evaluated as part of turning on Org mode. Rated high severity (CVSS 7.8), t
CVE-2023-2491 HIGH
7.8 May 17

A flaw was found in the Emacs text editor. Rated high severity (CVSS 7.8), this vulnerability is low attack complexity.

CVE-2023-27986 HIGH
7.8 Mar 09

emacsclient-mail.desktop in Emacs 28.1 through 28.2 is vulnerable to Emacs Lisp code injections through a crafted mailto
CVE-2023-27985 HIGH
7.8 Mar 09

emacsclient-mail.desktop in Emacs 28.1 through 28.2 is vulnerable to shell command injections through a crafted mailto:

CVE-2022-45939 HIGH
7.8 Nov 28

GNU Emacs through 28.2 allows attackers to execute commands via shell metacharacters in the name of a source-code file,

CVE-2014-9483 HIGH
7.5 Aug 28

Emacs 24.4 allows remote attackers to bypass security restrictions. Rated high severity (CVSS 7.5), this vulnerability i
CVE-2012-3479 MEDIUM
6.8 Aug 25

lisp/files.el in Emacs 23.2, 23.3, 23.4, and 24.1 automatically executes eval forms in local-variable sections when the

CVE-2024-30205 HIGH
7.1 Mar 25

In Emacs before 29.3, Org mode considers contents of remote files to be trusted. Rated high severity (CVSS 7.1), this vu

Same weakness CWE-190 – Integer Overflow or Wraparound

View all
CVE-2013-2729 CRITICAL POC
9.8
CVE-2015-8651 HIGH
8.8
CVE-2012-5054 HIGH POC
8.8
CVE-2014-0569 CRITICAL POC
9.3
CVE-2023-21716 CRITICAL POC
9.8
CVE-2017-3599 HIGH POC
7.5
CVE-2017-7529 HIGH
7.5
CVE-2016-1010 HIGH
8.8

Same technique RCE

View all
CVE-2021-44228 CRITICAL POC
10.0
CVE-2017-7269 CRITICAL POC
9.8
CVE-2022-47966 CRITICAL POC
9.8
CVE-2012-4681 CRITICAL POC
9.8
CVE-2023-3519 CRITICAL POC
9.8
CVE-2015-5119 CRITICAL POC
9.8
CVE-2016-4117 CRITICAL POC
9.8
CVE-2015-3113 CRITICAL POC
9.8

Vendor StatusVendor

SUSE

Severity: Important
Product Status
SUSE Linux Enterprise Desktop 15 SP7 Not-Affected
SUSE Linux Enterprise High Performance Computing 12 Not-Affected
SUSE Linux Enterprise High Performance Computing 15 SP7 Not-Affected
SUSE Linux Enterprise Module for Basesystem 15 SP7 Not-Affected
SUSE Linux Enterprise Module for Desktop Applications 15 SP7 Not-Affected

Share

EUVD-2026-55259 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy