CVE-2020-27930

CVE-2020-27930 is an out-of-bounds write (CWE-787) memory corruption flaw in the FontParser component used by Apple iOS, iPadOS, macOS, and watchOS. It is triggered when an application processes a maliciously crafted font, a file type commonly delivered remotely via web pages, email, documents, or messaging attachments. An attacker who successfully exploits it may achieve arbitrary code execution in the context of the application parsing the font. Any user of the affected Apple platforms running an unpatched OS version is potentially exposed, because font parsing is a core, remotely reachable code path. The flaw is listed in CISA's Known Exploited Vulnerabilities catalog (added 2021-11-03), indicating confirmed exploitation in the wild; no public proof-of-concept is known, CVSS is not yet scored, and EPSS ranks it in the 98th percentile with a 22% probability of exploitation within 30 days.

What to do: Apply Apple's OS updates for iOS, iPadOS, macOS, and watchOS that remediate CVE-2020-27930 per vendor instructions, prioritizing devices that render untrusted content and user workstations; as a KEV entry, federal agencies must patch by the catalog deadline. Until patched, reduce exposure by treating untrusted fonts as attack surface (avoid opening suspicious documents/attachments and remote content) and verify OS versions across your fleet with device management tooling.