CERT Polska has coordinated the disclosure of four vulnerabilities in GNU Emacs that a booby-trapped font file can trigger, in the worst case leading to code execution on the device. All four sit in the font parsing code used by the Android build of the editor, and every version up to and including Emacs 30.2 is listed as affected.
The flaws, CVE-2026-71391 through CVE-2026-71394, were published on 10 August 2026 in CERT Polska's advisory, and were reported by Michał Majchrowicz and Marcin Wyczechowski of the AFINE Team through the agency's coordinated vulnerability disclosure programme. No CVSS score is published for any of the four.
How an attack would work
Each bug is in src/sfnt.c, the TrueType font parser that Emacs on Android uses to render text. CERT Polska describes the same delivery path for all of them: an attacker gets a malicious font file in front of the editor by email, through EWW (the Emacs Web Wowser browser), or inside a document that uses custom faces, and Emacs loads it.
- CVE-2026-71391 is an off-by-one error (CWE-193) in the gvar table parser. A shared-coordinate boundary check uses a strict greater-than comparison instead of greater-than-or-equal, so a crafted TrueType variable font slips past it and triggers a heap-based out-of-bounds read. That exposes heap memory contents, which can later be used to defeat ASLR, the defence that randomises where code and data sit in memory.
- CVE-2026-71392 is an integer overflow (CWE-190) in the character map reader. An unguarded addition in the allocation call wraps around on 32-bit builds, producing a heap buffer overflow write and memory corruption that can lead to code execution.
- CVE-2026-71393 is a second integer overflow, this time in the name table reader. A 32-bit length value taken straight from the font is used to compute an allocation size with no overflow check, so on 32-bit targets a crafted font produces an undersized buffer that a subsequent read then overruns.
- CVE-2026-71394 is improper validation of a specified quantity in input (CWE-1284) in the table directory reader. A font that claims to contain more table directory entries than it actually has leaves uninitialised heap memory in the returned entries, which can mean information disclosure, crashes, or arbitrary memory access on 32-bit targets.
What you should do
Each issue has its own upstream fix commit, listed individually in CERT Polska's advisory, so the practical step is to move to a build that carries them rather than to watch for a single new version number. Emacs users on Android should update through whichever channel supplies their build.
The real exposure is narrower than the affected-versions line suggests. These are faults in Emacs's own font renderer on Android, not in desktop builds that leave font handling to the operating system, and three of the four are described as biting specifically on 32-bit targets. That still leaves a genuine attack surface for anyone who reads mail or browses the web from inside the editor, where a font arrives without the user ever choosing to open a file.
CERT Polska runs one of the more active coordinated disclosure programmes in Europe, and its incident work recently included an intrusion that reached a power plant through its private mobile network. Wider context on the country's cyber posture is in our Poland profile.
This briefing is provided by IntelFusions for informational and defensive purposes only. It is based on sources assessed to be reliable at the time of writing, and analytic judgments carry the confidence levels indicated. Indicators of compromise are defanged; re-arm them only in controlled environments. IntelFusions is not affiliated with the organizations named and makes no warranty as to completeness or accuracy.