An attacker can trigger an out‑of‑bounds read by supplying a malicious font, leading to the disclosure of process memory. The flaw is a classic input validation bug identified as CWE‑125. Because the data read is from memory, confidentiality is compromised while integrity is not directly affected.

Apple’s iOS, iPadOS, macOS, tvOS, visionOS and watchOS are affected. The vulnerability is fixed in iOS 18.4, iPadOS 18.4, macOS Sequoia 15.4, tvOS 18.4, visionOS 2.4 and watchOS 11.4.

The CVSS score is 5.5, indicating moderate risk, and the EPSS score of less than 1% suggests exploitation is unlikely at present. The vulnerability is not listed in CISA’s KEV catalog. Attackers must deliver a crafted font that the operating system processes, which is most likely a local attack or one that requires a user to install an application containing the malicious font. The exploit path therefore requires local interaction or a privileged application that can load the font, and there is no publicly known remote exploitation method.