PatchTheCVECVE-2026-71393: GNU Emacs for Android is vulnerable to an integer overflow in sfnt_read_name_table() in src/sfnt.c
31
Routine
MEDIUM 5.3
CVE-2026-71393 is a medium-severity flaw (CVSS 5.3) affecting affected software. Below: why it ranks where it does, which versions are affected, what to do, and the exact commands.
GNU Emacs for Android is vulnerable to an integer overflow in sfnt_read_name_table() in src/sfnt.c. The function computes an allocation size using a 32-bit length value from a TrueType font file without overflow checking. On 32-bit targets, a crafted font causes the calculation to wrap, resulting in an undersized heap allocation. A subsequent read() call writes beyond the buffer, causing a heap buffer overflow. An attacker can deliver a malicious
Why this priority
- No elevated risk signals yet
A fixed release or distro patch exists.
Risk facts
| CVSS score | 5.3 (Medium) |
| Attack vector | Network (remote) |
| Attack complexity | Low |
| Privileges needed | None |
| User interaction | Passive |
| EPSS exploit chance | 0.7% (top 48%) |
| CISA exploited list | No |
| Weakness | CWE-190 |
| Published | 2026-08-10 |
| Last modified | 2026-10-23 |
Publisher (CNA): CERT.PL
Timeline
- Published CVE record published
- Updated Record last modified
Exact fixes by distribution
Fedora 46 · clementine · FIXED · 1.4.2-1.fc46 · FEDORA-2026-3e748ef4d3 · source
sudo dnf upgrade --advisory=FEDORA-2026-3e748ef4d3
Debian 12 · emacs · NOT AFFECTED
Debian 13 · emacs · NOT AFFECTED
RHEL 10 · emacs · NOT AFFECTED
RHEL 6 · emacs · NOT AFFECTED
RHEL 7 · emacs · NOT AFFECTED
RHEL 8 · emacs · NOT AFFECTED
RHEL 9 · emacs · NOT AFFECTED
Verify at the official source NVD · CVE Program · Report a problem with this page
Scores and fixes here are computed automatically from those and other public sources. Confirm with the vendor advisory before changing production systems.
Scores and fixes here are computed automatically from those and other public sources. Confirm with the vendor advisory before changing production systems.