CVE-2016-1740

Vulnerability

FontParser in Apple iOS before 9.3, OS X before 10.11.4, tvOS before 9.2, and watchOS before 2.2 contains a memory corruption issue when parsing fonts embedded in PDF documents. This allows a remote attacker to trigger arbitrary code execution or denial of service via a specially crafted PDF file. [1][2][3][4]

Exploitation

An attacker can deliver a malicious PDF document to the target user, for example via email, web download, or other means. No authentication is required; the user only needs to open the PDF in an application that uses FontParser (e.g., Preview, Safari, or any PDF viewer on the affected system). The parsing of the crafted font data triggers memory corruption, leading to code execution.

Impact

Successful exploitation allows arbitrary code execution in the context of the application processing the PDF. This could lead to full system compromise on OS X, or app sandbox escape on iOS/tvOS/watchOS. Alternatively, the attacker could cause a denial of service via application termination.

Mitigation

Apple addressed this vulnerability in iOS 9.3, OS X El Capitan v10.11.4, tvOS 9.2, and watchOS 2.2, released on March 21, 2016. Users should update their devices to these versions or later. No workarounds are documented; the only mitigation is to apply the security updates. [1][2][3][4]