The vulnerability in GNU Emacs for Android (CVE-2026-71393) is an integer overflow in the sfnt_read_name_table() function. The function calculates an allocation size using a 32-bit length value extracted from a TrueType font file without checking for overflow. On 32-bit targets, a crafted font file can cause this calculation to wrap around, resulting in an undersized heap allocation. Subsequently, a read() operation writes beyond the allocated buffer, causing a heap buffer overflow. This can be triggered by an attacker delivering a malicious font file via email, EWW, or documents with custom faces that Emacs loads. The heap corruption may lead to potential code execution. The vulnerability was fixed in commit d51a4722316efe0960994d371e1859099894d1ca.

Successful exploitation can cause heap memory corruption and may allow an attacker to execute arbitrary code on affected systems running GNU Emacs for Android. The attack vector includes delivery of malicious font files through common Emacs features such as email, the web browser (EWW), or documents with custom font faces. The vulnerability affects 32-bit targets due to integer overflow in memory allocation calculations.

A fix for this vulnerability has been implemented in commit d51a4722316efe0960994d371e1859099894d1ca. Users should update GNU Emacs for Android to a version that includes this commit. Patch status is not explicitly confirmed in the provided data; therefore, verify the vendor advisory or official GNU Emacs repositories for the availability of the fixed version. Until patched, avoid opening untrusted font files or documents that may load custom fonts in Emacs.