CVE-2026-71392

A flaw was found in GNU Emacs, specifically in GNU Emacs for Android. An integer overflow can occur when a specially crafted font file is processed on 32-bit systems due to an unguarded addition during memory allocation. This can cause an undersized heap allocation and subsequently a heap-based buffer overflow, resulting in memory corruption and a denial of service.

To exploit this flaw, a user needs to load a malicious font file or a document with custom faces, limiting its exposure. Additionally, this flaw is specific to GNU Emacs for Android on 32-bit target systems. For these reasons, this vulnerability has been rated with a moderate severity.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.