Apple macOS CoreText Vulnerability Allows Sensitive Information Disclosure
A vulnerability in Apple macOS CoreText's GDEF LigCaretList feature allows remote attackers to disclose sensitive information, requiring user interaction for exploitation.
Zero Day Initiative (ZDI) has disclosed a vulnerability affecting Apple's macOS, specifically within the CoreText component's handling of GDEF LigCaretList features. This flaw, tracked as ZDI-26-831 and assigned CVE-2026-112656, permits remote attackers to read sensitive information from affected systems.
The vulnerability stems from an out-of-bounds read condition that occurs due to insufficient validation of user-supplied data during the parsing of ligature caret lists in fonts. When an attacker crafts a malicious font file or a webpage that leverages this font, and a user interacts with it, the vulnerability can be triggered. This could lead to an attacker gaining insights into memory contents or other sensitive data.
Exploitation of this vulnerability is not straightforward and requires a degree of user interaction. Typically, this would involve tricking a user into visiting a malicious website or opening a specially crafted file that contains the vulnerable font. The ZDI has assigned this vulnerability a CVSS score of 3.3, indicating a low severity for standalone exploitation but noting its potential to be chained with other vulnerabilities.
While the vulnerability itself is classified as an information disclosure flaw, the ZDI advisory suggests that it could be leveraged in conjunction with other security weaknesses to achieve more severe outcomes, such as remote code execution. This highlights the importance of addressing even lower-severity vulnerabilities, as they can serve as stepping stones for more sophisticated attacks.
Apple has acknowledged the issue and released a security update to address this vulnerability. Users are strongly advised to update their macOS installations to the latest version to mitigate the risk. The disclosure timeline indicates that the vulnerability was reported to Apple on August 12, 2026, and the coordinated public release of the advisory occurred on October 28, 2026, with an update to the advisory on the same day.
The vulnerability was discovered by NURIHAN KIM, also known as HanTul, who is credited for their work in identifying and reporting this security flaw. The ZDI plays a crucial role in coordinating with vendors to ensure vulnerabilities are patched before public disclosure, thereby protecting users from potential exploitation.
This disclosure is part of a broader trend of vulnerabilities being found in complex software components, underscoring the ongoing need for rigorous security testing and prompt patching by both vendors and users. The specific nature of the flaw in font rendering highlights the diverse attack surfaces present even in seemingly benign system functionalities.