CVE-2026-71391 is an off-by-one error (CWE-193) in GNU Emacs for Android's gvar table parser located in src/sfnt.c. The vulnerability arises because the shared-coordinate index boundary check in sfnt_vary_simple_glyph() and sfnt_vary_compound_glyph() uses a strict greater-than comparison rather than greater-than-or-equal, allowing a crafted TrueType variable font to bypass this check. This leads to a heap-based out-of-bounds read via memcpy. An attacker can deliver a malicious font through email, EWW, or documents with custom faces, causing Emacs to load the font and expose heap memory contents. This exposure can be leveraged to defeat ASLR. The issue was fixed in commit 95ab9ef627b212d74d321c5bbb5b56a1be7b9fbe, but no vendor advisory or patch release information is provided.

The vulnerability allows an attacker to cause a heap-based out-of-bounds read, exposing heap memory contents. This exposure can be used to bypass Address Space Layout Randomization (ASLR), weakening memory protection mechanisms. There is no indication of direct code execution or privilege escalation. The CVSS score is 5.3 (medium severity), reflecting a network attack vector with low complexity and no privileges required, but requiring user interaction.

A fix for this vulnerability was implemented in commit 95ab9ef627b212d74d321c5bbb5b56a1be7b9fbe. However, no official patch release or vendor advisory is provided in the available data. Users should monitor the GNU Emacs project for official updates or patches addressing this issue and apply them once available. Until then, caution is advised when opening untrusted font files or documents that may load custom fonts in Emacs.