Loading story…
Researchers detailed CVE-2021-1758, an out-of-bounds read in macOS libFontParser.dylib that can be triggered when CoreText processes a crafted legacy Mac Resource Fork font file. The bug affects parsing of .dfont files and was reproduced on macOS Catalina 10.15.4, where a malformed resource map can drive execution into GetResourcePtrCommon and cause memmove to read beyond the resource name list.
See affected versions and whether adversaries are exploiting it.
2 events from the most recent confirmed update back to the earliest known activity.
STAR Labs published a detailed write-up analyzing CVE-2021-1758 on 2021-09-14, describing how a crafted .dfont file could reach GetResourcePtrCommon and trigger an out-of-bounds read in CoreText. The post documented a proof of concept that caused a segmentation fault under GuardMalloc on macOS Catalina 10.15.4.
According to the analysis, researcher Peter found the vulnerability in macOS's libFontParser.dylib in February 2021. The bug involved unchecked resource name offsets in legacy Mac Resource Fork font parsing, leading to an out-of-bounds read.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Apple has released urgent security updates to address a critical vulnerability in its FontParser component, identified as CVE-2025-43400. This flaw affects a wide range of Apple operating systems, including iOS, iPadOS, macOS, visionOS, watchOS, and tvOS. The vulnerability is an out-of-bounds write issue in the system font parser, which could allow a maliciously crafted font file to cause unexpected application crashes or corrupt process memory. Security experts warn that, while there is no evidence of active exploitation, similar vulnerabilities have previously been leveraged for jailbreaks and spyware attacks. The flaw was discovered internally by Apple, and the company has not reported any incidents of it being exploited in the wild. Updates have been released for iOS 26.0.1 and 18.7.1, iPadOS 26.0.1 and 18.7.1, macOS Tahoe 26.0.1, Sequoia 15.7.1, and Sonoma 14.8.1, as well as visionOS 26.0.1, watchOS 26.0.2, and tvOS 26.0.1. The updates cover a broad range of devices, including iPhone 11 and later, various iPad Pro, Air, and mini models, and recent Mac computers. The vulnerability stems from insufficient bounds checking in the font processing code, which could potentially be chained with other vulnerabilities to achieve remote code execution. Apple recommends that all users update their devices promptly to mitigate the risk. The update process is straightforward, with instructions provided for iOS, iPadOS, macOS, and Apple Watch users. For macOS, users should utilize the Software Update feature in System Settings or System Preferences, depending on their version. For iOS and iPadOS, updates can be accessed via the Settings app under General > Software Update. Apple Watch users are advised to update through the Watch app on their paired iPhone. Although the watchOS and tvOS updates do not address security issues beyond this vulnerability, users are still encouraged to keep their devices current. The rapid release of these patches following major OS updates highlights Apple's commitment to addressing security issues promptly. Organizations and individual users are urged to deploy these updates as soon as possible to protect against potential exploitation. The vulnerability's technical details emphasize the importance of robust input validation in system components that handle untrusted data, such as font files. Security professionals note that, even in the absence of active attacks, the risk posed by such vulnerabilities warrants immediate action. Apple's internal discovery and swift remediation of CVE-2025-43400 demonstrate proactive security practices in the face of evolving threats.
Jun 29, 2026
Apple disclosed a fix in **macOS Ventura 13.5** for `CVE-2023-32443`, a high-severity flaw in the `sips` image-processing utility that could be triggered by a crafted ICC color profile. Security research showed the bug causes an **out-of-bounds read** while parsing malformed profile data, leading to application crashes, denial of service, and possible exposure of process memory contents; Apple said the issue was addressed through **improved input validation** across supported macOS releases including Ventura, Monterey, and Big Sur. The vulnerability reflects a broader class of parsing weaknesses described as **Color Profile Injection (CPI)**, where attacker-controlled offset, length, tag-count, or size fields inside binary color profile blobs can corrupt parsing logic and drive memory-safety failures. The underlying weakness maps to **`CWE-20` Improper Input Validation** and **`CWE-119` Improper Restriction of Operations within the Bounds of a Memory Buffer**, underscoring how malformed image metadata can become a path to memory disclosure and potentially code execution if structural fields in color profiles are trusted.
Aug 1, 2026
CERT Polska disclosed four vulnerabilities in **GNU Emacs for Android** affecting versions through **30.2**, tracked as `CVE-2026-71391`, `CVE-2026-71392`, `CVE-2026-71393`, and `CVE-2026-71394`. The flaws are triggered by specially crafted **TrueType font** files that Emacs may load through email content, the **EWW** web browser, or documents using custom faces. CERT Polska said the bugs reside in `src/sfnt.c` and can lead to out-of-bounds reads, heap buffer overflows, use of uninitialized heap memory, information disclosure, application crashes, and possible code execution. The disclosed issues include an **off-by-one error** (`CWE-193`), **two integer overflows** (`CWE-190`), and **improper input validation** in the font-parsing code. The vulnerabilities were responsibly reported by **Michał Majchrowicz** and **Marcin Wyczechowski** of the **AFINE Team**, and upstream fixes were released in specific commits referenced by CERT Polska as part of the coordinated disclosure.
Aug 10, 2026