Executive brief
Apple devices running iOS 27, iPadOS 27, macOS Golden Gate 27, and related OS versions contain an out-of-bounds read vulnerability in font processing. When a user opens a maliciously crafted font file, an attacker can read sensitive data from device memory, potentially exposing passwords, encryption keys, or other confidential information without requiring user interaction beyond opening the file.
Technical details
The vulnerability is an out-of-bounds read in the font parsing component of Apple's operating systems, triggered by processing maliciously crafted font files. The root cause is insufficient input validation when parsing font data structures. The attack vector is local and requires the user to interact with a malicious font (via email attachment, download, or embedded in a document); no authentication or elevated privileges are required. An attacker can read arbitrary process memory regions and disclose sensitive data such as credentials or encryption keys. The issue is fixed in iOS 27, iPadOS 27, macOS Golden Gate 27, tvOS 27, visionOS 27, and watchOS 27 through improved input validation.
Affected products
- Apple iOS up to 27
- Apple iPadOS up to 27
- Apple macOS Golden Gate up to 27
- Apple tvOS up to 27
- Apple visionOS up to 27
- Apple watchOS up to 27
Timeline
- 2026-09-14: patched: Fixed in iOS 27, iPadOS 27, macOS Golden Gate 27, tvOS 27, visionOS 27, watchOS 27
- 2026-09-14: disclosed