Vulnerability · Published Aug 10, 2026 · Assigned by CERT-PL
CVE-2026-71394Heap Use of Uninitialized Memory in GNU Emacs for Android
Medium 5.3
In plain English
A medium-severity security flaw in Emacs from GNU. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 39% of all known vulnerabilities).
Official description
GNU Emacs for Android improperly validates the table header input in sfnt_read_table_directory() in src/sfnt.c. Due to an incorrect comparison variable in the read-length check, a crafted font file that claims to contain more table directory entries than actually present causes the parser to return a struct with uninitialized heap memory in the table directory entries. An attacker can deliver a malicious font file via email, EWW (Emacs Web Wowser), or documents with custom faces, causing Emacs to load it. This leads to the use of uninitialized heap data in subsequent table lookups, potentially resulting in information disclosure, crashes, or arbitrary memory access on 32-bit targets. This issue is fixed after commit 7621ee1d01229d50e5c0cddea6bf0b01095a62cf
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian:12 | emacs | no fix listed | DEBIAN-CVE-2026-71394 |
| Debian:13 | emacs | no fix listed | DEBIAN-CVE-2026-71394 |
| Debian:14 | emacs | no fix listed | DEBIAN-CVE-2026-71394 |
| Ubuntu:26.10 | emacs | no fix listed | UBUNTU-CVE-2026-71394 |
| Ubuntu:22.04:LTS | xemacs21 | no fix listed | UBUNTU-CVE-2026-71394 |
| Ubuntu:24.04:LTS | xemacs21 | no fix listed | UBUNTU-CVE-2026-71394 |
| Ubuntu:26.04:LTS | xemacs21 | no fix listed | UBUNTU-CVE-2026-71394 |
| Ubuntu:26.10 | xemacs21 | no fix listed | UBUNTU-CVE-2026-71394 |
| Ubuntu:22.04:LTS | xemacs21-packages | no fix listed | UBUNTU-CVE-2026-71394 |
| Ubuntu:24.04:LTS | xemacs21-packages | no fix listed | UBUNTU-CVE-2026-71394 |
| Ubuntu:26.04:LTS | xemacs21-packages | no fix listed | UBUNTU-CVE-2026-71394 |
| Ubuntu:26.10 | xemacs21-packages | no fix listed | UBUNTU-CVE-2026-71394 |
Affected products (as reported)
Weakness: CWE-1284 · Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:L/SC:L/SI:L/SA:N
References
- https://cert.pl/en/posts/2026/08/CVE-2026-71391 third-party-advisory
- https://www.gnu.org/savannah-checkouts/gnu/emacs/emacs.html product