Apple has released security updates for its operating systems, addressing a vulnerability in the Apple Font Parser that could allow malicious fonts to crash applications or corrupt process memory.
See also: Veritas: Apple's internal chatbot for Siri AI upgrades
The vulnerability, identified as CVE-2025-43400, affects a wide range of products, including the new macOS Tahoe and iOS 26, as well as older versions.
The vulnerability is an out-of-bounds write issue in the Apple Font Parser. This type of memory safety flaw allows a program to write data beyond the end of a reserved buffer, leading to unpredictable behavior.
An attacker could exploit this issue by embedding a specially crafted font in a document, email, or web page. When a user interacts with this content, the vulnerable Font Parser component could be triggered, potentially leading to an application termination or memory corruption.
See also: Apple responds to class action lawsuit over Siri features
Apple addressed the issue by implementing improved bounds checking, ensuring that the software stays within the designated memory space when processing font data.
According to Apple's announcement released on September 29, 2025, there are no known instances of exploitation of this vulnerability.
It remains unclear whether the flaw could be exploited to execute arbitrary code, which would be a more serious threat. However, the potential for denial of service attacks or memory corruption makes it a critical issue that needs to be addressed.
The fix targets a wide range of Apple products, highlighting the common code base across its ecosystem.
See also: EU Digital Markets Law in Apple's sights
While Apple also released updates for watchOS and tvOS, these did not include fixes for this vulnerability. Users are strongly encouraged to apply the latest updates to all affected devices to mitigate any potential risk.
🔒 Protect your privacy with Proton VPN
Swiss VPN from the creators of Proton Mail — strict no-logs policy, strong encryption, and built-in NetShield that blocks ads, trackers, & malware.
- ✔ No-logs, based in Switzerland (except 14-Eyes)
- ✔ NetShield: blocks ads, trackers & malicious domains
- ✔ Covers all devices — free version available
The link is an affiliate link — SecNews may receive a commission at no additional cost to you. It does not affect the independence of our article writing.
