The vulnerability in GNU Emacs for Android arises from improper validation of the number of table directory entries in the sfnt_read_table_directory() function within src/sfnt.c. An attacker can craft a malicious font file that falsely claims to contain more table directory entries than actually present. Due to an incorrect comparison variable in the read-length check, the parser returns a struct containing uninitialized heap memory for these entries. When Emacs subsequently accesses these entries, it uses uninitialized memory, which can lead to information disclosure, application crashes, or arbitrary memory access on 32-bit targets. The vulnerability is addressed by a specific code commit (7621ee1d01229d50e5c0cddea6bf0b01095a62cf).

Exploitation of this vulnerability can lead to information disclosure, application crashes, or arbitrary memory access on 32-bit systems running GNU Emacs for Android. The attack vector involves delivering a malicious font file via email, Emacs Web Wowser (EWW), or documents with custom faces that cause Emacs to load the crafted font. There is no indication of active exploitation in the wild.

A fix for this vulnerability is available and has been applied in the commit 7621ee1d01229d50e5c0cddea6bf0b01095a62cf. Users should update GNU Emacs for Android to a version that includes this fix. Since no official patch version or advisory is provided, users should monitor the GNU project for updated releases containing this commit. Patch status is not yet confirmed in official releases — check the vendor advisory for current remediation guidance.