CVE-2026-86970 in iOS
Summary
by MITRE • 10/26/2026
An out-of-bounds read was addressed with improved input validation. This issue is fixed in iOS 26.7.2 and iPadOS 26.7.2, iOS 27.2 and iPadOS 27.2, macOS Golden Gate 27.2, macOS Sequoia 15.8.2, macOS Tahoe 26.7.2, tvOS 27.2, visionOS 27.2, watchOS 27.2. Processing a maliciously crafted font may result in the disclosure of process memory.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 10/26/2026
The vulnerability described involves an out-of-bounds read condition within the system's font processing subsystem, specifically triggered by the parsing and rendering of malformed or maliciously constructed font files. This type of flaw typically arises when software fails to properly validate the boundaries of data structures before accessing memory locations associated with them. In this instance, the application processes input from a font file without sufficiently checking whether the requested read operation extends beyond the allocated buffer limits. When such an invalid access occurs, the system may retrieve and expose sensitive information stored in adjacent memory regions that were not intended to be accessible by the current process context. This behavior constitutes a classic example of CWE-125, which is categorized as Out-of-bounds Read, where software reads data past the end or before the beginning of the intended buffer.
The operational impact of this vulnerability centers on the potential disclosure of process memory contents. An attacker who can trick a user into opening a specially crafted font file could exploit this flaw to read arbitrary bytes from the application's address space. Depending on what is loaded in those adjacent memory locations, an attacker might extract cryptographic keys, authentication tokens, session cookies, or other sensitive data that provides insight into the system's state and security posture. While immediate code execution is not guaranteed by a simple out-of-bounds read, such information leakage can serve as a critical stepping stone for further exploitation chains. It allows attackers to map memory layouts, bypass address space layout randomization protections indirectly through information gathering, or identify specific library versions and configurations that may be vulnerable to other known exploits. This aligns with the ATT&CK technique of T1082, System Information Discovery, where adversaries gather detailed system configuration data to facilitate subsequent attacks.
The resolution for this issue involves implementing improved input validation mechanisms within the font processing engine. By rigorously checking buffer boundaries and ensuring that all read operations remain strictly within allocated memory regions, the software prevents unauthorized access to adjacent memory blocks. This fix ensures that malformed inputs are either rejected early in the parsing phase or handled safely without triggering invalid memory accesses. The vulnerability has been addressed across multiple Apple operating systems including iOS 26.7.2 and iPadOS 26.7.2, as well as newer versions like iOS 27.2 and iPadOS 27.2. It is also patched in macOS Golden Gate 27.2, macOS Sequoia 15.8.2, macOS Tahoe 26.7.2, tvOS 27.2, visionOS 27.2, and watchOS 27.2. Users are strongly advised to update their devices immediately to mitigate the risk of memory disclosure attacks via malicious font files.