Apple urges users to update iPhone and Mac to patch font bug

Apple released iOS and macOS updates to fix a medium-severity flaw in font processing that could trigger a denial-of-service condition or memory corruption, tracked as CVE-2025-43400. The vulnerability is an out-of-bounds write in the FontParser component, which could allow a remote attacker to cause crashes or memory corruption and potentially execute arbitrary code.

Processing a maliciously crafted font may lead to unexpected app termination or corrupt memory, with the advisory noting that an out-of-bounds write issue was addressed with improved bounds checking.

The updates are available for iPhone 11 and later, iPad Pro 12.9-inch 3rd generation and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd generation and later, iPad 8th generation and later, and iPad mini 5th generation and later, and include iOS 26.0.1, 18.7.1, macOS 26.0.1, 15.7.1, 14.8.1, and visionOS 26.0.1, with older platforms also receiving patches.

According to Hong Kong CERT’s advisory, a remote attacker can exploit the vulnerability remotely, and Apple urges users to update as soon as possible since it is not yet clear whether the flaw has been exploited in the wild.