CVE-2026-71394

A flaw was found in GNU Emacs, specifically in GNU Emacs for Android. The parser can return a structure with uninitialized heap memory when a specially crafted font file is processed due to an improper validation. This can lead to the use of uninitialized heap data, potentially resulting in information disclosure, application crashes or arbitrary memory access on 32-bit systems.

To exploit this flaw, a user needs to load a malicious font file or a document with custom faces, limiting its exposure. Additionally, this flaw is specific to GNU Emacs for Android. For these reasons, this vulnerability has been rated with a moderate severity.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.