Apple Updates iOS and macOS to Prevent Malicious Font Attacks

Apple has released a new round of security updates for iOS and macOS to fix a single medium-severity vulnerability affecting both platforms. Tracked as CVE-2025-43400, the flaw is an out-of-bounds write in the FontParser component that could lead to a denial-of-service or memory corruption. Processing a maliciously crafted font may lead to unexpected app termination or corrupt process memory, Apple notes.

According to Hong Kong CERT and Akaoma Cybersecurity, the vulnerability can be exploited remotely without privileges, though user interaction is required. The fixes arrive with updates to iOS 26.0.1, iPadOS 26.0.1, macOS Tahoe 26.0.1, iOS 18.7.1, iPadOS 18.7.1, macOS Sequoia 15.7.1 and macOS Sonoma 14.8.1, and are included in visionOS 26.0.1, with Apple urging organisations to keep fleet devices current.

As SANS Institute’s Johannes Ullrich notes, such .0.1 updates typically follow a major release and address security issues, while Jamf’s Adam Boynton emphasises the need to update promptly to prevent potential service disruptions.