CVE-2026-71394

{
  "id": "CVE-2026-71394",
  "sourceIdentifier": "[email protected]",
  "published": "2026-08-10T11:17:28.697",
  "lastModified": "2026-10-24T15:10:00.190",
  "vulnStatus": "Deferred",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "GNU Emacs for Android improperly validates the table header input in sfnt_read_table_directory() in src/sfnt.c. Due to an incorrect comparison variable in the read-length check, a crafted font file that claims to contain more table directory entries than actually present causes the parser to return a struct with uninitialized heap memory in the table directory entries. An attacker can deliver a malicious font file via email, EWW (Emacs Web Wowser), or documents with custom faces, causing Emacs to load it. This leads to the use of uninitialized heap data in subsequent table lookups, potentially resulting in information disclosure, crashes, or arbitrary memory access on 32-bit targets.\n\n\nThis issue is fixed after commit 7621ee1d01229d50e5c0cddea6bf0b01095a62cf"
    },
    {
      "lang": "es",
      "value": "GNU Emacs para Android valida incorrectamente la entrada del encabezado de la tabla en sfnt_read_table_directory() en src/sfnt.c. Debido a una variable de comparación incorrecta en la verificación de longitud de lectura, un archivo de fuente manipulado que afirma contener más entradas de directorio de tabla de las realmente presentes hace que el analizador devuelva una estructura con memoria de pila no inicializada en las entradas del directorio de la tabla. Un atacante puede entregar un archivo de fuente malicioso a través de correo electrónico, EWW (Emacs Web Wowser) o documentos con caras personalizadas, haciendo que Emacs lo cargue. Esto lleva al uso de datos de pila no inicializados en búsquedas de tabla posteriores, lo que podría resultar en revelación de información, fallos o acceso arbitrario a la memoria en objetivos de 32 bits.\n\nEste problema se soluciona después del commit 7621ee1d01229d50e5c0cddea6bf0b01095a62cf"
    }
  ],
  "affected": [
    {
      "source": "[email protected]",
      "affectedData": [
        {
          "vendor": "GNU",
          "product": "Emacs",
          "defaultStatus": "unaffected",
          "platforms": [
            "Android"
          ],
          "programFiles": [
            "src/sfnt.c"
          ],
          "repo": "https://cgit.git.savannah.gnu.org/cgit/emacs.git",
          "versions": [
            {
              "version": "0",
              "lessThanOrEqual": "30.2",
              "versionType": "custom",
              "status": "affected",
              "changes": [
                {
                  "at": "commit 7621ee1d01229d50e5c0cddea6bf0b01095a62cf",
                  "status": "unaffected"
                }
              ]
            }
          ]
        }
      ]
    }
  ],
  "metrics": {
    "cvssMetricV40": [
      {
        "source": "[email protected]",
        "type": "Secondary",
        "cvssData": {
          "version": "4.0",
          "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:L/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
          "baseScore": 5.3,
          "baseSeverity": "MEDIUM",
          "attackVector": "NETWORK",
          "attackComplexity": "LOW",
          "attackRequirements": "NONE",
          "privilegesRequired": "NONE",
          "userInteraction": "PASSIVE",
          "vulnConfidentialityImpact": "NONE",
          "vulnIntegrityImpact": "NONE",
          "vulnAvailabilityImpact": "LOW",
          "subConfidentialityImpact": "LOW",
          "subIntegrityImpact": "LOW",
          "subAvailabilityImpact": "NONE",
          "exploitMaturity": "NOT_DEFINED",
          "confidentialityRequirement": "NOT_DEFINED",
          "integrityRequirement": "NOT_DEFINED",
          "availabilityRequirement": "NOT_DEFINED",
          "modifiedAttackVector": "NOT_DEFINED",
          "modifiedAttackComplexity": "NOT_DEFINED",
          "modifiedAttackRequirements": "NOT_DEFINED",
          "modifiedPrivilegesRequired": "NOT_DEFINED",
          "modifiedUserInteraction": "NOT_DEFINED",
          "modifiedVulnConfidentialityImpact": "NOT_DEFINED",
          "modifiedVulnIntegrityImpact": "NOT_DEFINED",
          "modifiedVulnAvailabilityImpact": "NOT_DEFINED",
          "modifiedSubConfidentialityImpact": "NOT_DEFINED",
          "modifiedSubIntegrityImpact": "NOT_DEFINED",
          "modifiedSubAvailabilityImpact": "NOT_DEFINED",
          "Safety": "NOT_DEFINED",
          "Automatable": "NOT_DEFINED",
          "Recovery": "NOT_DEFINED",
          "valueDensity": "NOT_DEFINED",
          "vulnerabilityResponseEffort": "NOT_DEFINED",
          "providerUrgency": "NOT_DEFINED"
        }
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "timestamp": "2026-08-10T17:49:27.242917Z",
          "id": "CVE-2026-71394",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "version": "2.0.3"
        }
      }
    ]
  },
  "weaknesses": [
    {
      "source": "[email protected]",
      "type": "Secondary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-1284"
        }
      ]
    }
  ],
  "references": [
    {
      "url": "https://cert.pl/en/posts/2026/08/CVE-2026-71391",
      "source": "[email protected]"
    },
    {
      "url": "https://www.gnu.org/savannah-checkouts/gnu/emacs/emacs.html",
      "source": "[email protected]"
    }
  ]
}