7 matches found
SUSE CVE-2026-71393
GNU Emacs for Android is vulnerable to an integer overflow in sfntreadnametable in src/sfnt.c. The function computes an allocation size using a 32-bit length value from a TrueType font file without overflow checking. On 32-bit targets, a crafted font causes the calculation to wrap, resulting in a...
CVE-2026-71393
GNU Emacs for Android is vulnerable to an integer overflow in sfntreadnametable in src/sfnt.c. The function computes an allocation size using a 32-bit length value from a TrueType font file without overflow checking. On 32-bit targets, a crafted font causes the calculation to wrap, resulting in a...
UBUNTU-CVE-2026-71393
GNU Emacs for Android is vulnerable to an integer overflow in sfntreadnametable in src/sfnt.c. The function computes an allocation size using a 32-bit length value from a TrueType font file without overflow checking. On 32-bit targets, a crafted font causes the calculation to wrap, resulting in a...
CVE-2026-71393 Heap Buffer Overflow in GNU Emacs for Android
GNU Emacs for Android is vulnerable to an integer overflow in sfntreadnametable in src/sfnt.c. The function computes an allocation size using a 32-bit length value from a TrueType font file without overflow checking. On 32-bit targets, a crafted font causes the calculation to wrap, resulting in a...
CVE-2026-71393
CVE-2026-71393 affects GNU Emacs for Android. A 32-bit font length value in sfnt_read_name_table() can overflow when computing the allocation size, causing an undersized heap allocation. A crafted TrueType font can trigger a read() past the buffer, leading to heap memory corruption and potential ...
CVE-2026-71393
GNU Emacs for Android is vulnerable to an integer overflow in sfntreadnametable in src/sfnt.c. The function computes an allocation size using a 32-bit length value from a TrueType font file without overflow checking. On 32-bit targets, a crafted font causes the calculation to wrap, resulting in a...
CVE-2026-71393: Integer Overflow or Wraparound
GNU Emacs for Android is vulnerable to an integer overflow in sfntreadnametable in src/sfnt.c. The function computes an allocation size using a 32-bit length value from a TrueType font file without overflow checking. On 32-bit targets, a crafted font causes the calculation to wrap, resulting in a...