CVE-2026-71391

GNU Emacs for Android is affected by an off-by-one in the gvar table parser (src/sfnt.c). The shared-coordinate index boundary check in sfnt_vary_simple_glyph() and sfnt_vary_compound_glyph() uses a > comparison instead of >=, allowing a crafted TrueType variable font to bypass the check an...