The vulnerability in GNU Emacs for Android (CVE-2026-71392) is an integer overflow in the sfnt_read_cmap_format_12() function within src/sfnt.c. On 32-bit builds, an unguarded addition in the xmalloc call wraps around, causing a heap buffer overflow write when processing a malicious TrueType font file. This can be triggered by an attacker delivering a crafted font file via email, EWW, or documents with custom faces, leading to heap memory corruption and possible code execution. The issue was resolved in commit c4e20777c26548722a37b03db93243e83a0d6188.

Successful exploitation can result in heap memory corruption and potentially allow remote code execution on affected 32-bit GNU Emacs for Android systems. The attack vector includes delivery of malicious font files through common user-facing channels such as email and web browsing within Emacs. The CVSS 4.0 base score is 5.3, indicating a medium severity vulnerability with network attack vector, no privileges required, and user interaction needed.

A fix for this vulnerability is available as it was resolved in commit c4e20777c26548722a37b03db93243e83a0d6188. Users should update GNU Emacs for Android to a version that includes this commit. Since no official patch version or advisory is provided here, users should consult the GNU Emacs project repository or official channels to obtain the fixed version. No alternative mitigations or workarounds are indicated.