The vulnerability in GNU Emacs for Android is an integer overflow in the sfnt_read_name_table() function, which calculates an allocation size from a 32-bit length value in a TrueType font file without checking for overflow. On 32-bit targets, this causes the allocation size calculation to wrap around, resulting in an undersized heap buffer. A subsequent read() operation writes beyond this buffer, causing a heap buffer overflow. This can be exploited by an attacker who delivers a malicious font file through email, EWW, or documents with custom faces, potentially leading to heap memory corruption and code execution. The issue was fixed in a specific commit identified as d51a4722316efe0960994d371e1859099894d1ca.

Successful exploitation of this vulnerability can lead to heap memory corruption and potentially arbitrary code execution on affected systems running GNU Emacs for Android. The attack vector includes delivering a malicious TrueType font file via email, the Emacs Web Wowser, or documents with custom faces that cause Emacs to load the crafted font. The vulnerability affects 32-bit targets due to integer overflow in allocation size calculation.

A fix for this vulnerability has been implemented in commit d51a4722316efe0960994d371e1859099894d1ca. Users and administrators should apply this update to mitigate the risk. Since no official patch link or advisory is provided, verify the presence of this commit in your Emacs build or update to a version including this fix. No additional vendor advisory states otherwise.