CVE catalog
CVE-2026-71394
GNU Emacs for Android improperly validates the table header input in sfnt_read_table_directory() in src/sfnt.c. Due to an incorrect comparison variable in the read-length check, a crafted font file th
- Severity
- Medium · CVSS 5.3
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L - Published
- Source
- [NVD] · [CVE record]
- EPSS
- 0.45% · Oct 25, 2026
GNU Emacs for Android improperly validates the table header input in sfnt_read_table_directory() in src/sfnt.c. Due to an incorrect comparison variable in the read-length check, a crafted font file that claims to contain more table directory entries than actually present causes the parser to return a struct with uninitialized heap memory in the table directory entries. An attacker can deliver a malicious font file via email, EWW (Emacs Web Wowser), or documents with custom faces, causing Emacs to load it. This leads to the use of uninitialized heap data in subsequent table lookups, potentially resulting in information disclosure, crashes, or arbitrary memory access on 32-bit targets. This issue is fixed after commit 7621ee1d01229d50e5c0cddea6bf0b01095a62cf
Vulnerable and fixed packages
Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.
| Distribution | Package | Release | Version | Status |
|---|---|---|---|---|
| Debian | emacs | sid | 1:30.2+1-11 | not affected |
| Debian | emacs | forky | 1:30.2+1-11 | not affected |
| Debian | emacs | trixie | 1:30.1+1-6+deb13u1 | not affected |
| Debian | emacs | trixie-security | 1:30.1+1-6+deb13u1 | not affected |
| Debian | emacs | bookworm | 1:28.2+1-15+deb12u4 | not affected |
| Debian | emacs | bookworm-security | 1:28.2+1-15+deb12u4 | not affected |
Fixed-version evidence
| Distribution | Package | Type | Release | Fixed version | Urgency | Origin | Bugs |
|---|---|---|---|---|---|---|---|
| Debian | emacs | source | sid | Not affected | unimportant | Not reported | Not reported |
| Debian | emacs | source | forky | Not affected | unimportant | Not reported | Not reported |
| Debian | emacs | source | trixie | Not affected | unimportant | Not reported | Not reported |
| Debian | emacs | source | bookworm | Not affected | unimportant | Not reported | Not reported |
OpenFactory catalog packages
[Debian 12 (Bookworm)]
- [emacs]Not affected
Details (6)
1:28.2+1-15+deb12u4· all · bookwormNot affected
nvd · emacs · debian · bookworm
1:28.2+1-15+deb12u4· all · bookwormNot affected
nvd · emacs · debian · bookworm
1:30.1+1-6~bpo12+1· all · bookworm-backportsNot affected
nvd · emacs · debian · bookworm
1:30.1+1-6~bpo12+1· all · bookworm-backportsNot affected
nvd · emacs · debian · bookworm
1:28.2+1-15+deb12u4· all · bookworm-securityNot affected
nvd · emacs · debian · bookworm
1:28.2+1-15+deb12u4· all · bookworm-securityNot affected
nvd · emacs · debian · bookworm
- [emacs-bin-common]Not affected
Source package: [emacs]
Details (6)
1:28.2+1-15+deb12u4· amd64 · bookwormNot affected
nvd · emacs · debian · bookworm
1:28.2+1-15+deb12u4· arm64 · bookwormNot affected
nvd · emacs · debian · bookworm
1:30.1+1-6~bpo12+1· amd64 · bookworm-backportsNot affected
nvd · emacs · debian · bookworm
1:30.1+1-6~bpo12+1· arm64 · bookworm-backportsNot affected
nvd · emacs · debian · bookworm
1:28.2+1-15+deb12u4· amd64 · bookworm-securityNot affected
nvd · emacs · debian · bookworm
1:28.2+1-15+deb12u4· arm64 · bookworm-securityNot affected
nvd · emacs · debian · bookworm
- [emacs-common]Not affected
Source package: [emacs]
Details (6)
1:28.2+1-15+deb12u4· all · bookwormNot affected
nvd · emacs · debian · bookworm
1:28.2+1-15+deb12u4· all · bookwormNot affected
nvd · emacs · debian · bookworm
1:30.1+1-6~bpo12+1· all · bookworm-backportsNot affected
nvd · emacs · debian · bookworm
1:30.1+1-6~bpo12+1· all · bookworm-backportsNot affected
nvd · emacs · debian · bookworm
1:28.2+1-15+deb12u4· all · bookworm-securityNot affected
nvd · emacs · debian · bookworm
1:28.2+1-15+deb12u4· all · bookworm-securityNot affected
nvd · emacs · debian · bookworm
- [emacs-el]Not affected
Source package: [emacs]
Details (6)
1:28.2+1-15+deb12u4· all · bookwormNot affected
nvd · emacs · debian · bookworm
1:28.2+1-15+deb12u4· all · bookwormNot affected
nvd · emacs · debian · bookworm
1:30.1+1-6~bpo12+1· all · bookworm-backportsNot affected
nvd · emacs · debian · bookworm
1:30.1+1-6~bpo12+1· all · bookworm-backportsNot affected
nvd · emacs · debian · bookworm
1:28.2+1-15+deb12u4· all · bookworm-securityNot affected
nvd · emacs · debian · bookworm
1:28.2+1-15+deb12u4· all · bookworm-securityNot affected
nvd · emacs · debian · bookworm
- [emacs-gtk]Not affected
Source package: [emacs]
Details (6)
1:28.2+1-15+deb12u4· amd64 · bookwormNot affected
nvd · emacs · debian · bookworm
1:28.2+1-15+deb12u4· arm64 · bookwormNot affected
nvd · emacs · debian · bookworm
1:30.1+1-6~bpo12+1· amd64 · bookworm-backportsNot affected
nvd · emacs · debian · bookworm
1:30.1+1-6~bpo12+1· arm64 · bookworm-backportsNot affected
nvd · emacs · debian · bookworm
1:28.2+1-15+deb12u4· amd64 · bookworm-securityNot affected
nvd · emacs · debian · bookworm
1:28.2+1-15+deb12u4· arm64 · bookworm-securityNot affected
nvd · emacs · debian · bookworm
- [emacs-lucid]Not affected
Source package: [emacs]
Details (6)
1:28.2+1-15+deb12u4· amd64 · bookwormNot affected
nvd · emacs · debian · bookworm
1:28.2+1-15+deb12u4· arm64 · bookwormNot affected
nvd · emacs · debian · bookworm
1:30.1+1-6~bpo12+1· amd64 · bookworm-backportsNot affected
nvd · emacs · debian · bookworm
1:30.1+1-6~bpo12+1· arm64 · bookworm-backportsNot affected
nvd · emacs · debian · bookworm
1:28.2+1-15+deb12u4· amd64 · bookworm-securityNot affected
nvd · emacs · debian · bookworm
1:28.2+1-15+deb12u4· arm64 · bookworm-securityNot affected
nvd · emacs · debian · bookworm
- [emacs-nox]Not affected
Source package: [emacs]
Details (6)
1:28.2+1-15+deb12u4· amd64 · bookwormNot affected
nvd · emacs · debian · bookworm
1:28.2+1-15+deb12u4· arm64 · bookwormNot affected
nvd · emacs · debian · bookworm
1:30.1+1-6~bpo12+1· amd64 · bookworm-backportsNot affected
nvd · emacs · debian · bookworm
1:30.1+1-6~bpo12+1· arm64 · bookworm-backportsNot affected
nvd · emacs · debian · bookworm
1:28.2+1-15+deb12u4· amd64 · bookworm-securityNot affected
nvd · emacs · debian · bookworm
1:28.2+1-15+deb12u4· arm64 · bookworm-securityNot affected
nvd · emacs · debian · bookworm
- [emacs-pgtk]Not affected
Source package: [emacs]
Details (2)
1:30.1+1-6~bpo12+1· amd64 · bookworm-backportsNot affected
nvd · emacs · debian · bookworm
1:30.1+1-6~bpo12+1· arm64 · bookworm-backportsNot affected
nvd · emacs · debian · bookworm
Observed:
References
- [https://cert.pl/en/posts/2026/08/CVE-2026-71391]
- [https://nvd.nist.gov/vuln/detail/CVE-2026-71394]
- [https://osv.dev/vulnerability/DEBIAN-CVE-2026-71394]
- [https://security-tracker.debian.org/tracker/CVE-2026-71394]
- [https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-71394.json]
- [https://wid.cert-bund.de/.well-known/csaf/white/2026/wid-sec-w-2026-2721.json]
- [https://www.gnu.org/savannah-checkouts/gnu/emacs/emacs.html]
[CERT-Bund public advisories] · [Debian Security Tracker] · [FIRST EPSS] · [National Vulnerability Database (NVD)] · [OSV Package Vulnerability Database] · [Red Hat security advisories and VEX]