CVE-2026-71391 is an off-by-one error (CWE-193) in GNU Emacs for Android's gvar table parser located in src/sfnt.c. The vulnerability arises because the boundary check for shared-coordinate indices in the functions sfnt_vary_simple_glyph() and sfnt_vary_compound_glyph() uses a strict greater-than comparison rather than greater-than-or-equal. This allows a crafted TrueType variable font to bypass the boundary check and cause a heap-based out-of-bounds read via memcpy. An attacker can deliver such a malicious font through email, EWW, or documents with custom faces, causing Emacs to load it and potentially leak heap memory contents that could be used to defeat ASLR. The issue was fixed in commit 95ab9ef627b212d74d321c5bbb5b56a1be7b9fbe.

The vulnerability allows an attacker to cause a heap-based out-of-bounds read, which can expose heap memory contents. This information leak can be leveraged to defeat Address Space Layout Randomization (ASLR), potentially facilitating further exploitation. There is no indication of direct code execution or privilege escalation from this vulnerability alone.

A fix for this vulnerability exists and was implemented in commit 95ab9ef627b212d74d321c5bbb5b56a1be7b9fbe. Users should update GNU Emacs for Android to a version that includes this commit. Since no explicit affected versions or patch releases are provided, users should consult the official GNU Emacs repositories or vendor advisories for the fixed version. Until updated, avoid opening untrusted font files or documents with custom faces in Emacs.