CVE-2026-71391 GNU CVE debrief

Who should care

Users of GNU Emacs for Android, especially those who process untrusted font files, should be aware of this vulnerability and take steps to mitigate it. This includes updating to a version that includes the fix and being cautious when processing untrusted font files. Additionally, security teams should review their asset inventory to identify potentially affected systems and prioritize updates accordingly. Vulnerability management processes should also be updated to account for this issue in the future. Platform operators may need to review custom font handling and consider compensating controls for exposed systems while remediation is scheduled and verified. Monitoring and detection capabilities may need to be updated to identify potential exploitation attempts. Rollback and change window management processes should also be reviewed to ensure timely and secure updates. Source tracking and incident response plans should be updated to account for potential exploitation of this vulnerability. Asset inventory management should be used to identify and prioritize updates for affected systems. Compensating controls such as secure font rendering mechanisms should be considered for exposed systems. Monitoring and detection capabilities should be reviewed to identify potential exploitation attempts. Rollback and change window management processes should be updated to ensure timely and secure updates. Source tracking and incident response plans should be updated to account for potential exploitation of this vulnerability. Asset inventory management should be used to identify and prioritize updates for affected systems. Compensating controls such as secure font rendering mechanisms should be considered for exposed systems. Monitoring and detection capabilities should be reviewed to identify potential exploitation attempts. Rollback and change window management processes should be updated to ensure timely and secure updates. Source tracking and incident response plans should be updated to account for potential exploitation of this vulnerability. Asset inventory management should be used to identify and prioritize updates for affected systems. Compensating controls such as se

Technical summary

The vulnerability is caused by an off-by-one error in the gvar table parser in src/sfnt.c. The shared-coordinate index boundary check in sfnt_vary_simple_glyph() and sfnt_vary_compound_glyph() uses a strict greater-than comparison instead of greater-than-or-equal, allowing a crafted TrueType variable font to bypass the check and trigger a heap-based out-of-bounds read via memcpy. This exposes heap memory contents which can be later used to defeat ASLR. The vulnerability was fixed in commit 95ab9ef627b212d74d321c5bbb5b56a1be7b9fbe.

Defensive priority

Emacs users should prioritize updating to a version that includes the fix for this vulnerability, especially if they process untrusted font files.

Recommended defensive actions

• Update Emacs to a version that includes the fix
• Be cautious when processing untrusted font files
• Consider using secure font rendering mechanisms
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The issue is caused by an off-by-one error in the gvar table parser in src/sfnt.c, specifically in the shared-coordinate index boundary check in sfnt_vary_simple_glyph() and sfnt_vary_compound_glyph(). This allows a crafted TrueType variable font to trigger a heap-based out-of-bounds read via memcpy. The vulnerability was fixed in commit 95ab9ef627b212d74d321c5bbb5b56a1be7b9fbe. Defenders should verify that their Emacs installations are updated to a version that includes this fix, especially if they process untrusted font files.

Official resources