The vulnerability in GNU Emacs for Android arises from improper validation of the specified quantity in the font table directory input within the sfnt_read_table_directory() function in src/sfnt.c. An incorrect comparison variable in the read-length check allows a maliciously crafted font file to claim more table directory entries than actually present. This causes the parser to return a structure containing uninitialized heap memory in the table directory entries. When Emacs loads such a font file—delivered via email, EWW browser, or documents with custom faces—subsequent table lookups may use this uninitialized memory, potentially resulting in information disclosure, application crashes, or arbitrary memory access on 32-bit targets. The issue has been addressed and fixed in a specific commit (7621ee1d01229d50e5c0cddea6bf0b01095a62cf).

Exploitation of this vulnerability can lead to information disclosure, application crashes, or arbitrary memory access on 32-bit systems running GNU Emacs for Android. The vulnerability arises from use of uninitialized heap memory due to improper input validation of font table directory entries. There is no indication of active exploitation in the wild.

A fix for this vulnerability is available and has been applied in the commit 7621ee1d01229d50e5c0cddea6bf0b01095a62cf. Users and administrators should update GNU Emacs for Android to a version that includes this fix. Since no official patch version or advisory is provided, check the GNU Emacs project repositories or official channels for the updated version containing this commit.