CVE-2026-71391

A flaw was found in GNU Emacs, specifically in GNU Emacs for Android. An off-by-one error can occur when a specially crafted font file is processed due to an improper bounds check. This can cause a heap-based buffer over-read, exposing heap memory contents.

To exploit this flaw, a user needs to load a malicious font file or a document with custom faces, limiting its exposure. The only security impact of this issue is an information disclosure of heap memory contents. Additionally, this flaw is specific to GNU Emacs for Android. For these reasons, this vulnerability has been rated with a low severity.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.