Technical impact
An out‑of‑bounds read vulnerability was discovered in Apple’s font‑parsing subsystem. Receiving a maliciously crafted font file allows the system to read memory beyond a legitimate buffer, triggering an unexpected application termination. This results in a denial‑of‑service condition, compromising application availability but not providing an attacker with code execution or data disclosure. The flaw manifests as a crash, instantly disrupting the user experience.
Affected Systems
The affected Apple operating systems include iOS 26.7, iOS 27, iPadOS 26.7, iPadOS 27, macOS Golden Gate 27, macOS Sequoia 15.8, macOS Tahoe 26.7, tvOS 27, visionOS 27, and watchOS 27. Devices running any of these platform versions are vulnerable until a patched build is installed.
Risk and Exploitability
The most probable attack vector is the delivery of a crafted font file to the device, often via an application that accepts user‑supplied typography. While the vulnerability does not expose data or allow arbitrary code execution, the exploit can repeatedly crash target applications, causing minor disruption to user productivity. The EPSS score of less than 1 % and absence from the CISA KEV catalog indicate that exploitation is unlikely, yet the low‑severity denial‑of‑service represents a valid threat for users relying on consistent application functionality.
