Get DeafLetter
A weekly selection of signals, vulnerabilities and guides. Critical alerts remain optional.
You can unsubscribe at any time. Privacy policy.
A malicious font file can trick Apple's CoreText rendering engine into reading memory outside its allocated bounds, leaking sensitive information. The vulnerability, tracked as CVE-2026-112656 and disclosed in advisory ZDI-26-831 by the Trend Micro Zero Day Initiative on October 28, 2026, requires only that a victim open a document or visit a web page containing the compromised font.
- CVE-2026-112656 is an out-of-bounds read in the parsing of ligature caret lists in fonts, within Apple macOS's CoreText component.
- The attack requires user interaction: opening a malicious file or visiting a web page that triggers font rendering.
- The primary impact is information disclosure; the same primitive can be chained with other vulnerabilities to achieve code execution.
- The CVE Record lists ten patched versions, but the ZDI-26-831 advisory confirms technical details only for macOS.
The Flaw Mechanism
According to advisory ZDI-26-831, the flaw resides in the "parsing of ligature caret lists in fonts." The issue stems from a lack of validation of user-supplied data, allowing a read past the end of an allocated buffer. The official CVE Record describes the fix as "improved bounds checking," confirming the defect was insufficient boundary validation during typographic structure parsing.
The term "ligature caret lists" refers to a font structure that defines cursor insertion positions within ligatures — composite glyphs that join letters. The primary sources do not specify additional architectural details on the OpenType subtables involved.
"The specific flaw exists within the parsing of ligature caret lists in fonts. The issue results from the lack of proper validation of user-supplied data, which can result in a read past the end of an allocated buffer." — ZDI Advisory ZDI-26-831
Verified Impacts and Limits
Advisory ZDI-26-831 explicitly classifies the vulnerability as information disclosure on "affected installations of Apple macOS." The wording is precise: this is not direct remote code execution, but a process memory read primitive.
The same source adds a critical element for risk assessment: "An attacker can leverage this in conjunction with other vulnerabilities to execute code in the context of the current process." Memory disclosure provides information — base addresses, memory layout — that can make exploitation of a second flaw reliable.
No evidence emerges from the sources of in-the-wild exploitation prior to the patch. The researcher who discovered the vulnerability is not named. The CVSS score is not reported in the ZDI advisory.
Patch Scope: What the Sources Confirm
The CVE Record lists ten system versions with fixes: iOS 26.7.2 and 27.2, iPadOS 26.7.2 and 27.2, macOS Golden Gate 27.2, macOS Sequoia 15.8.2, macOS Tahoe 26.7.2, tvOS 27.2, visionOS 27.2, and watchOS 27.2. This list documents that Apple patched the vulnerability on these platforms.
However, advisory ZDI-26-831 speaks explicitly only of "Apple macOS." It is not verifiable from available sources whether the vulnerable component is identical on iOS, iPadOS, tvOS, visionOS, or watchOS, nor whether CoreText operates with the same parsing surface across all these platforms. The CVE Record lists patched versions but does not confirm CoreText is the shared component on each.
It is not possible to establish from available sources whether CVE-2026-112656 also appears in specific security advisories published by Apple. The Apple Support source (support.apple.com/en-ca/149230) is truncated and does not show this identifier in the extracted text.
What to Do Now
Patch priority depends on exposure profile. Users who regularly receive PDF documents from external sources — professionals, journalists, researchers, enterprise users — have a larger attack surface and should update urgently. Users with controlled, limited document sources have inherently lower but non-zero risk: compromised legitimate web pages can serve malicious fonts.
The practical criterion is to verify the installed version against the patch list in the CVE Record. For macOS, the fixed versions are Sequoia 15.8.2, Tahoe 26.7.2, or Golden Gate 27.2. For mobile devices, iOS and iPadOS 26.7.2 or 27.2. The sources contain no indication of release timelines or regionally differentiated availability.
Disclosure Context and Limits
The timeline shows vendor notification on August 12, 2026, and coordinated publication on October 28, 2026: a window of roughly two and a half months. This interval aligns with standard vendor-reporter coordination timelines in the ZDI program.
The primary sources for this case are two: advisory ZDI-26-831, which provides technical details and confirms CVE-2026-112656, and the official CVE Record, which lists patched versions. No independent second source is available to confirm or contextualize the real exploitation risk. The analysis therefore rests on a single structured primary source plus the corroborating CVE record.
For users, the concrete risk remains potential process memory disclosure during rendering of untrusted fonts. Exactly what an attacker can read beyond "process memory" is not specified in the sources: they do not detail whether the read is confined to the font parser's address space or can extend more broadly.
Sources
Get DeafLetter
A weekly selection of signals, vulnerabilities and guides. Critical alerts remain optional.
You can unsubscribe at any time. Privacy policy.