Full Report
CERT Polska has received a report about 4 vulnerabilities (from CVE-2026-71391 to CVE-2026-71394) found in GNU Emacs software.
Analysis Summary
# Vulnerability: Multiple Memory Safety Flaws in GNU Emacs (sfnt.c)
## CVE Details
- **CVE ID:** CVE-2026-71391, CVE-2026-71392, CVE-2026-71393, CVE-2026-71394
- **CVSS Score:** Not explicitly provided in the source (Typically High for RCE/Information Disclosure in this context)
- **CWE:**
- CWE-193: Off-by-one Error (CVE-2026-71391)
- CWE-190: Integer Overflow or Wraparound (CVE-2026-71392, CVE-2026-71393)
- CWE-1284: Improper Validation of Specified Quantity in Input (CVE-2026-71394)
## Affected Systems
- **Products:** GNU Emacs
- **Versions:** All versions through 30.2
- **Configurations:** Primarily impacts **Android** builds and **32-bit** architectures.
## Vulnerability Description
A series of vulnerabilities were discovered in the `src/sfnt.c` component of GNU Emacs, which handles the parsing of TrueType variable fonts.
1. **CVE-2026-71391:** An off-by-one error in the `gvar` table parser due to a strict comparison check (`>`) instead of (`>=`). This allows a heap-based out-of-bounds read via `memcpy`.
2. **CVE-2026-71392:** An integer overflow during an `xmalloc` call in the `cmap` format 12 parser. On 32-bit builds, this leads to an undersized allocation and subsequent heap buffer overflow.
3. **CVE-2026-71393:** An integer overflow in the `name` table parser where 32-bit length values are processed without overflow checks, leading to a heap buffer overflow during a `read()` operation.
4. **CVE-2026-71394:** Improper validation of table header lengths. A crafted font claiming more entries than present leads to the use of uninitialized heap memory in table lookups.
## Exploitation
- **Status:** Reported via CVD; PoC status not explicitly confirmed as public, but technical details are documented.
- **Complexity:** Medium (Requires crafting a malicious font file).
- **Attack Vector:** Network (Delivered via email, EWW/Emacs Web Wowser, or documents with custom faces).
## Impact
- **Confidentiality:** High (Information disclosure of heap memory; ASLR bypass).
- **Integrity:** High (Potential for heap memory corruption and arbitrary code execution).
- **Availability:** High (Potential for application crashes).
## Remediation
### Patches
The issues have been addressed in the following Git commits:
- **CVE-2026-71391:** 95ab9ef627b212d74d321c5bbb5b56a1be7b9fbe
- **CVE-2026-71392:** c4e20777c26548722a37b03db93243e83a0d6188
- **CVE-2026-71393:** d51a4722316efe0960994d371e1859099894d1ca
- **CVE-2026-71394:** 7621ee1d01229d50e5c0cddea6bf0b01095a62cf
Users should update to a version containing these fixes (versions post-30.2).
### Workarounds
- Avoid opening untrusted documents or browsing unfamiliar websites using EWW in Emacs until the software is updated.
- Use 64-bit builds where possible, as some overflows specifically target 32-bit memory management logic.
## Detection
- **Indicators of Compromise:** Unusual Emacs crashes when loading specific fonts or rendering documents.
- **Detection Methods:** Monitor for unexpected memory access patterns or crashes in `src/sfnt.c` logic. Security scanners can be updated to check for Emacs versions ≤ 30.2.
## References
- hxxps://cert[.]pl/en/cve/
- hxxps://www[.]cve[.]org/CVERecord?id=CVE-2026-71391
- hxxps://www[.]cve[.]org/CVERecord?id=CVE-2026-71392
- hxxps://www[.]cve[.]org/CVERecord?id=CVE-2026-71393
- hxxps://www[.]cve[.]org/CVERecord?id=CVE-2026-71394