EUVD-2026-77900
GHSA-fm7h-qp46-crpm
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessCraft malicious font file
-
DeliveryDeliver to victim (document/web/message)
-
ExploitVictim's app processes font
-
ExecutionOut-of-bounds read triggered
-
ImpactApplication unexpectedly terminates (DoS)
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Bounds checking, read limits
MITRE ATT&CK
1 technique across 1 tactic: Collection The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires the victim to process a maliciously crafted font file (UI:R) using a vulnerable Apple OS version (iOS/iPadOS <26.7 or <27, macOS <15.8/<26.7/<27, tvOS/visionOS/watchOS <27). No authentication or privileges are needed by the attacker (PR:N), but the attack is GATED on delivering the font to the victim and getting an application to parse it - the attacker cannot trigger it remotely without that interaction. Impact is limited to termination of the processing application (denial of service); there is no code execution, privilege gain, or data disclosure, which substantially limits real-world severity. |
| Impact | This is a genuinely low-priority issue despite the network attack vector. The vendor CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L, base 4.3) is consistent with the description: processing a maliciously crafted font file causes only unexpected app termination - a pure availability impact (A:L) with no confidentiality or integrity loss (C:N/I:N). EPSS is 0.21% (11th percentile), reinforcing very low exploitation likelihood. There is no KEV listing (not actively exploited) and no public exploit identified at time of analysis, so exploitation status is 'no public exploit identified.' The one signal worth flagging is a metadata conflict: the input Tags include 'Information Disclosure,' which directly contradicts the CVSS vector's C:N - this is an out-of-bounds READ that leaks nothing to the attacker, it only crashes the process, so the tag is mislabeled. 'Buffer Overflow' is also loose since a bounded OOB read produces termination, not code execution. Net: a real but minor denial-of-service bug requiring user interaction, correctly rated Medium/Low; not a patch-tonight priority. |
| Exploit ScenarioDerived | An attacker crafts a malformed font file and delivers it to a victim (embedded in a document, webpage, or message) whose Apple device parses it via the vulnerable font-handling code. When the font is processed, the out-of-bounds read triggers an unexpected termination of the affected application. No public exploit code is identified, and the impact is limited to a crash - no code execution or data disclosure. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 17, 2026
An out-of-bounds read in Apple's font-processing code can crash (terminate) an application on iOS, iPadOS, macOS, tvOS, visionOS and watchOS when it parses a maliciously crafted font file, but it cannot be used to execute code, escalate privileges, or steal data. The issue affects iOS/iPadOS before 26.7 and before 27, macOS before Sequoia 15.8, Tahoe 26.7 and Golden Gate 27, and tvOS, visionOS and watchOS before 27, and it is fixed in those listed releases; the assessed vector (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L, score 4.3) confirms that unauthenticated remote attackers can only succeed if a victim is induced to open or render the crafted font (user interaction required), and exploitation yields availability loss only. No public exploit code has been identified at time of analysis and the EPSS score is 0.21% (11th percentile), so real-world exploitation is unlikely; this is a genuinely low-priority issue despite the network attack vector.
RemediationAI
Vendor-released patch: iOS 26.7 and iPadOS 26.7, iOS 27 and iPadOS 27, macOS Sequoia 15.8, macOS Tahoe 26.7, macOS Golden Gate 27, tvOS 27, visionOS 27 and watchOS 27, per Apple advisories https://support.apple.com/en-us/149034 through 149043. Updating all Apple devices that consume untrusted content (mail, messaging, Safari, document viewers) is the complete fix; because the flaw is reachable through font files rendered from web pages or attachments, prioritize iPadOS/iOS and macOS endpoints exposed to external content, and note that macOS Sequoia 15.8 covers only the older branch while Tahoe 26.7 and Golden Gate 27 cover the newer ones. Where immediate upgrades are not feasible, reduce exposure by restricting the ability to install arbitrary font profiles (remove untrusted configuration profiles and disable font installation by unmanaged users), avoid opening documents or visiting pages from unverified sources on vulnerable builds, and rely on OS sandboxing/per-app isolation so a crash is contained to the rendering application - each of these is only a partial mitigation because any application that parses a font can still be terminated by a crafted file, and the trade-off is reduced functionality for users who legitimately install custom fonts. No vendor-released patch gap remains for this CVE, so no additional compensating controls are required beyond the updates listed above.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 5 packages in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The root cause is a CWE-125 out-of-bounds read in the font parsing subsystem that Apple's operating systems use to interpret font files supplied by applications, documents, or downloaded content; Apple addressed it with improved bounds checking in the fixed releases. Font parsers are a classic memory-safety attack surface because they consume complex, attacker-influenceable binary formats (tables, glyph metrics, name and layout records), and a missing length check can let the parser read past the end of an allocated buffer. In this case the read is non-destructive to memory integrity: the CVSS vector AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L, consistent with the assessed vector, shows no confidentiality or integrity impact and only a low availability impact confined to the processing application, which typically manifests as unexpected app termination rather than a kernel compromise. The CPE entries (apple:ios_and_ipados, apple:macos, apple:tvos, apple:visionos, apple:watchos) confirm the defect lives in shared Apple platform code rather than a single product, which is why the same fix appears across the entire OS family in one coordinated update.
Know when macOS gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L
Malicious font can arrive remotely but requires the victim to open/process it (UI:R); an OOB read yields only app termination, so C:N/I:N/A:L, matching vendor 4.3.
Primary rating from Vendor (apple).
CVSS VectorVendor: apple
Lifecycle Timeline
4DescriptionCVE.org
An out-of-bounds read was addressed with improved bounds checking. This issue is fixed in iOS 26.7 and iPadOS 26.7, iOS 27 and iPadOS 27, macOS Golden Gate 27, macOS Sequoia 15.8, macOS Tahoe 26.7, tvOS 27, visionOS 27, watchOS 27. Processing a maliciously crafted font file may lead to unexpected app termination.
Threat Intelligence Overview
NVD
CVE.org
EPSS
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.
An unauthenticated remote code execution vulnerability exists in Remote for Mac, a macOS remote control utility develope
Out-of-bounds write in Apple's iOS, iPadOS, and macOS file-parsing code lets remote attackers achieve arbitrary code exe
Apple's kernel across all platforms (iOS, macOS, watchOS, visionOS, tvOS) contains a memory corruption vulnerability (CV
The issue was addressed with improved checks. Rated high severity (CVSS 7.0). Actively exploited in the wild (cisa kev)
A logic issue was addressed with improved restrictions. Rated high severity (CVSS 7.8), this vulnerability is no authent
In Sudo before 1.9.12p2, the sudoedit (aka -e) feature mishandles extra arguments passed in the user-provided environmen
A race condition was addressed with additional validation. Rated high severity (CVSS 7.0), this vulnerability is no auth
This issue was addressed with improved checks. Rated critical severity (CVSS 10.0), this vulnerability is remotely explo
A carefully crafted request body can cause a buffer overflow in the mod_lua multipart parser (r:parsebody() called from
Cross-Site Request Forgery (CSRF) vulnerability in Laundry on Linux, MacOS allows to perform an Account Takeover. This i
A vulnerability was found in LibTIFF. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, no aut
Use of Out-of-range Pointer Offset in GitHub repository vim/vim prior to 8.2.4440. Rated high severity (CVSS 8.8), this
Exploit-DB