CVE-2026-71392 is an integer overflow vulnerability (CWE-190) in GNU Emacs for Android's sfnt_read_cmap_format_12() function located in src/sfnt.c. On 32-bit builds, an unguarded addition in the xmalloc allocation call wraps around, causing a heap buffer overflow write when processing a crafted TrueType font file. An attacker can exploit this by delivering a malicious font file through email, EWW, or documents with custom faces, causing Emacs to load the file and leading to heap memory corruption and potential code execution. The vulnerability was fixed in commit c4e20777c26548722a37b03db93243e83a0d6188.

Successful exploitation results in heap memory corruption that can lead to arbitrary code execution. The vulnerability is remotely exploitable without privileges or user interaction beyond opening a malicious font file in Emacs. The CVSS 4.0 base score is 5.3 (medium severity), reflecting network attack vector, low attack complexity, no privileges required, user interaction required, and limited impact on confidentiality and integrity.

A fix for this vulnerability is available and was implemented in commit c4e20777c26548722a37b03db93243e83a0d6188. Users should update GNU Emacs for Android to a version that includes this commit. Patch status is not explicitly confirmed in vendor advisories; therefore, verify the presence of this fix in your Emacs build. Until patched, avoid opening untrusted TrueType font files via email, EWW, or documents with custom faces.