Apple released iOS and macOS updates to fix a flaw in font processing that could trigger a denial-of-service condition or memory corruption.
Apple released iOS and macOS updates to address a medium-severity flaw, tracked as CVE-2025-43400, in font processing that could trigger a denial-of-service condition or memory corruption.
The CVE-2025-43400 flaw is an out-of-bounds write issue in the operating system’s FontParser component. An out-of-bounds (OOB) write vulnerability occurs when a program writes data outside the memory buffer allocated for it. This can corrupt adjacent memory, leading to crashes, unpredictable behavior, or even allowing attackers to execute arbitrary code.
An attacker can craft a malicious font that can cause apps to crash or corrupt process memory, potentially leading to arbitrary code execution.
“Processing a maliciously crafted font may lead to unexpected app termination or corrupt process memory.” reads the advisory. “An out-of-bounds write issue was addressed with improved bounds checking.”
Apple issued updates for iOS 26, macOS 26, and older platforms to address the bug. Releases include iOS/iPadOS 26.0.1, 18.7.1, macOS 26.0.1, 15.7.1, 14.8.1, and visionOS 26.0.1.
“Typically, fonts are safe and standardized files used daily in countless apps and websites, but due to this vulnerability an attacker can create a specially crafted font file containing manipulated data that exploits vulnerabilities in the font processing engine of the operating system. When this malicious font is loaded by an app or system process, it can trigger memory corruption or crashes. In worst-case scenarios, this can enable attackers to execute harmful code remotely, gaining control over the device.” reads the analysis published by Malwarebytes. “Given that fonts are widely used and often processed silently in the background, font vulnerabilities pose a significant risk vector for attackers aiming to compromise devices.”
Hong Kong CERT’s advisory confirms that a remote attacker can exploit the vulnerability remotely.
The updates are available for iPhone 11 and later, iPad Pro 12.9-inch 3rd generation and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd generation and later, iPad 8th generation and later, and iPad mini 5th generation and later
At this time, it is unclear if the flaw has been exploited in attacks in the wild. Users should update their devices as soon as possible.
Follow me on Twitter: @securityaffairs and Facebook and Mastodon
(SecurityAffairs – hacking, iOS)
