High [CVE-2026-71393] integer overflow via a malicious font file
This high-severity Red Hat Linux advisory covers CVE-2026-71393.
Aggregated and source-linked by VulniPulse. Data sources, validation and limitations.
VulniPulse record published Record updated
Android app · Google Play
Monitor future Red Hat Linux CVEs from your phone.
Choose a whole vendor or a precise platform, then receive matching security advisories by phone notification, email, or both. Coverage follows 34 official vendor sources and 160+ reviewed platform categories.
Summary
GNU Emacs for Android is vulnerable to an integer overflow in sfnt_read_name_table() in src/sfnt.c. The function computes an allocation size using a 32-bit length value from a TrueType font file without overflow checking.
On 32-bit targets, a crafted font causes the calculation to wrap, resulting in an undersized heap allocation. A subsequent read() call writes beyond the buffer, causing a heap buffer overflow.
An attacker can deliver a malicious font file via email, EWW (Emacs Web Wowser), or documents with custom faces, causing Emacs to load it. This can lead to heap memory corruption and potential code execution.
This issue was fixed in commit d51a4722316efe0960994d371e1859099894d1ca An integer overflow can occur when a specially crafted font file is processed on 32-bit systems due to an improper overflow checking. This can cause an undersized heap allocation and subsequently a heap-based buffer overflow, resulting in memory corruption and a denial of service.
To exploit this flaw, a user needs to load a malicious font file or a document with custom faces, limiting its exposure. Additionally, this flaw is specific to GNU Emacs for Android on 32-bit target systems.
For these reasons, this vulnerability has been rated with a moderate severity. Red Hat severity: Moderate — CVSS 7.8 (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H).
Weakness: CWE-190.
Affected versions
No affected-version range was extracted from the source record. The vendor advisory is authoritative — check it before change work.
Official advisory · high-confidence parse· fetched 30 days ago·verify at source
Fixed versions
No fixed release is recorded yet. That does not prove no patch exists — confirm against the vendor advisory.
Official advisory · high-confidence parse· fetched 30 days ago·verify at source
Mitigation checklist
- Do not load untrusted font files or open unverified documents with custom faces.
Official advisory · high-confidence parse· fetched 30 days ago·verify at source
Discussion(0)
No comments yet. Share field notes, upgrade gotchas, or questions — verify against the vendor advisory before acting on community advice.
Sign in to join the discussion.