Every CVE Search/ Get API key

CVE-2026-71392

Integer Overflow in GNU Emacs for Android

5.3 Medium

GNU Emacs for Android is vulnerable to an integer overflow in the sfnt_read_cmap_format_12() function in src/sfnt.c. When processing a crafted TrueType font file, an unguarded addition in the xmalloc allocation call wraps around on 32-bit builds, causing a heap buffer overflow write. An attacker can deliver a malicious font file via email, EWW (Emacs Web Wowser), or documents with custom faces, causing Emacs to load it. This results in heap memory corruption that can lead to code execution.

This issue was fixed in commit c4e20777c26548722a37b03db93243e83a0d6188

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
Low
Privileges needed
None
User interaction
Passive

What an attacker can affect

Confidentiality
None
Integrity
None
Availability
Low

Exploit likelihood

0.67%Up 0.3 points since Aug 11, 2026
90%50%10%1%

What each source reports

CVE List Score used 5.3

Integer Overflow in GNU Emacs for Android

GNU Emacs for Android is vulnerable to an integer overflow in the sfnt_read_cmap_format_12() function in src/sfnt.c. When processing a crafted TrueType font file, an unguarded addition in the xmalloc allocation call wraps around on 32-bit builds, causing a heap buffer overflow write. An attacker can deliver a malicious font file via email, EWW (Emacs Web Wowser), or documents with custom faces, causing Emacs to load it. This results in heap memory corruption that can lead to code execution.

This issue was fixed in commit c4e20777c26548722a37b03db93243e83a0d6188

Record
CVE-2026-71392
CVSS 4.0
5.3 MediumCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:L/SC:N/SI:L/SA:N
Weakness
CWE-190
Updated
2026-11-02
EUVDEUVD-2026-55259 5.3

GNU Emacs for Android is vulnerable to an integer overflow in the sfnt_read_cmap_format_12() function in src/sfnt.c. When processing a crafted TrueType font file, an unguarded addition in the xmalloc allocation call wraps around on 32-bit builds, causing a heap buffer overflow write. An attacker can deliver a malicious font file via email, EWW (Emacs Web Wowser), or documents with custom faces, causing Emacs to load it. This results in heap memory corruption that can lead to code execution.

This issue was fixed in commit c4e20777c26548722a37b03db93243e83a0d6188

Record
EUVD-2026-55259
CVSS 4.0
5.3 MediumCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:L/SC:N/SI:L/SA:N
Updated
2026-11-02
GitHub AdvisoriesGHSA-39p3-jw8m-jmr7 5.3

GNU Emacs for Android is vulnerable to an integer overflow in the sfnt_read_cmap_format_12()...

GNU Emacs for Android is vulnerable to an integer overflow in the sfnt_read_cmap_format_12() function in src/sfnt.c. When processing a crafted TrueType font file, an unguarded addition in the xmalloc allocation call wraps around on 32-bit builds, causing a heap buffer overflow write. An attacker can deliver a malicious font file via email, EWW (Emacs Web Wowser), or documents with custom faces, causing Emacs to load it. This results in heap memory corruption that can lead to code execution.

This issue was fixed in commit c4e20777c26548722a37b03db93243e83a0d6188

Record
GHSA-39p3-jw8m-jmr7
CVSS 4.0
5.3 MediumCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:L/SC:N/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Weakness
CWE-190
Updated
2026-11-02
NVD 5.3

GNU Emacs for Android is vulnerable to an integer overflow in the sfnt_read_cmap_format_12() function in src/sfnt.c. When processing a crafted TrueType font file, an unguarded addition in the xmalloc allocation call wraps around on 32-bit builds, causing a heap buffer overflow write. An attacker can deliver a malicious font file via email, EWW (Emacs Web Wowser), or documents with custom faces, causing Emacs to load it. This results in heap memory corruption that can lead to code execution.

This issue was fixed in commit c4e20777c26548722a37b03db93243e83a0d6188

Record
CVE-2026-71392
CVSS 4.0
5.3 MediumCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:L/SC:N/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Weakness
CWE-190
Updated
2026-11-02
OSV 5.3

Integer Overflow in GNU Emacs for Android

GNU Emacs for Android is vulnerable to an integer overflow in the sfnt_read_cmap_format_12() function in src/sfnt.c. When processing a crafted TrueType font file, an unguarded addition in the xmalloc allocation call wraps around on 32-bit builds, causing a heap buffer overflow write. An attacker can deliver a malicious font file via email, EWW (Emacs Web Wowser), or documents with custom faces, causing Emacs to load it. This results in heap memory corruption that can lead to code execution.

This issue was fixed in commit c4e20777c26548722a37b03db93243e83a0d6188

Record
CVE-2026-71392
CVSS 4.0
5.3 MediumCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:L/SC:N/SI:L/SA:N
Weakness
CWE-190
Updated
2026-11-07
OSVDEBIAN-CVE-2026-71392 5.3

GNU Emacs for Android is vulnerable to an integer overflow in the sfnt_read_cmap_format_12() function in src/sfnt.c. When processing a crafted TrueType font file, an unguarded addition in the xmalloc allocation call wraps around on 32-bit builds, causing a heap buffer overflow write. An attacker can deliver a malicious font file via email, EWW (Emacs Web Wowser), or documents with custom faces, causing Emacs to load it. This results in heap memory corruption that can lead to code execution. This issue was fixed in commit c4e20777c26548722a37b03db93243e83a0d6188

Record
DEBIAN-CVE-2026-71392
CVSS 4.0
5.3 MediumCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:L/SC:N/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Updated
2026-11-02
OSVUBUNTU-CVE-2026-71392 5.3

GNU Emacs for Android is vulnerable to an integer overflow in the sfnt_read_cmap_format_12() function in src/sfnt.c. When processing a crafted TrueType font file, an unguarded addition in the xmalloc allocation call wraps around on 32-bit builds, causing a heap buffer overflow write. An attacker can deliver a malicious font file via email, EWW (Emacs Web Wowser), or documents with custom faces, causing Emacs to load it. This results in heap memory corruption that can lead to code execution. This issue was fixed in commit c4e20777c26548722a37b03db93243e83a0d6188

Record
UBUNTU-CVE-2026-71392
CVSS 4.0
5.3 MediumCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:L/SC:N/SI:L/SA:N
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
emacs24
Ubuntu:Pro:16.04:LTS
 All versions, plus listed versions
24.5+1-1ubuntu224.5+1-1ubuntu424.5+1-1ubuntu524.5+1-1ubuntu624.5+1-1ubuntu7
Show 6 moreShow less
24.5+1-6ubuntu124.5+1-6ubuntu1.124.5+1-6ubuntu1.1+esm124.5+1-6ubuntu1.1+esm224.5+1-6ubuntu1.1+esm324.5+1-6ubuntu1.1+esm4
 None known
xemacs21
Ubuntu:16.04:LTS
 All versions, plus listed versions
21.4.22-4ubuntu321.4.22-14ubuntu1
 None known
xemacs21-packages
Ubuntu:16.04:LTS
 All versions, plus listed versions
2009.02.17.dfsg.2-2
 None known
emacs25
Ubuntu:Pro:18.04:LTS
 All versions, plus listed versions
25.2+1-625.2+1-6ubuntu0.1~esm2
 None known
xemacs21
Ubuntu:18.04:LTS
 All versions, plus listed versions
21.4.24-4ubuntu121.4.24-5ubuntu1
 None known
xemacs21-packages
Ubuntu:18.04:LTS
 All versions, plus listed versions
2009.02.17.dfsg.2-4
 None known
emacs
Ubuntu:Pro:20.04:LTS
 All versions, plus listed versions
1:26.3+1-1ubuntu11:26.3+1-1ubuntu21:26.3+1-1ubuntu2+esm11:26.3+1-1ubuntu2+esm2
 None known
xemacs21
Ubuntu:20.04:LTS
 All versions, plus listed versions
21.4.24-8build121.4.24-9
 None known
xemacs21-packages
Ubuntu:20.04:LTS
 All versions, plus listed versions
2009.02.17.dfsg.2-42009.02.17.dfsg.2-5
 None known
xemacs21
Ubuntu:22.04:LTS
 All versions, plus listed versions
21.4.24-9ubuntu2
 None known
Show 11 moreShow less
Affected packages
PackageAffectedFixed
xemacs21-packages
Ubuntu:22.04:LTS
 All versions, plus listed versions
2009.02.17.dfsg.2-5
 None known
emacs
Ubuntu:Pro:22.04:LTS
 All versions, plus listed versions
1:27.1+1-3ubuntu31:27.1+1-3ubuntu51:27.1+1-3ubuntu5.11:27.1+1-3ubuntu5.21:27.1+1-3ubuntu5.2+esm1
 None known
xemacs21
Ubuntu:24.04:LTS
 All versions, plus listed versions
21.4.24-1221.4.24-12build221.4.24-12build3
 None known
xemacs21-packages
Ubuntu:24.04:LTS
 All versions, plus listed versions
2009.02.17.dfsg.3-22009.02.17.dfsg.3-3
 None known
emacs
Ubuntu:Pro:24.04:LTS
 All versions, plus listed versions
1:29.1+1-5ubuntu11:29.2+1-1ubuntu11:29.2+1-2ubuntu41:29.3+1-1ubuntu21:29.3+1-1ubuntu2+esm11:29.3+1-1ubuntu2+esm31:29.3+1-1ubuntu2+esm4
 None known
emacs
Ubuntu:26.10
 All versions, plus listed versions
1:30.2+1-2ubuntu11:30.2+1-6ubuntu11:30.2+1-11ubuntu1
 None known
xemacs21
Ubuntu:26.10
 All versions, plus listed versions
21.4.24-12build3
 None known
xemacs21-packages
Ubuntu:26.10
 All versions, plus listed versions
2009.02.17.dfsg.3-3build1
 None known
xemacs21
Ubuntu:26.04:LTS
 All versions, plus listed versions
21.4.24-12build3
 None known
xemacs21-packages
Ubuntu:26.04:LTS
 All versions, plus listed versions
2009.02.17.dfsg.3-32009.02.17.dfsg.3-3build1
 None known
emacs
Ubuntu:Pro:26.04:LTS
 All versions, plus listed versions
1:30.1+1-9ubuntu11:30.2+1-1ubuntu21:30.2+1-2ubuntu11:30.2+1-2ubuntu1+esm1
 None known

History

History
RecordedChangedSources
factsOSV
affectedOSV
first indexedCVE List, EUVD, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2026-71392 is a medium vulnerability (CVSS 5.3) in Gnu Emacs, published August 10, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.67%, the 52nd percentile. No source names a fixed version.

References

Show 4 moreShow less
Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open