CVE-2020-27930: Apple font parsing out-of-bounds write allows code execution

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 17 September 2026. Confidence: high.

high priorityThe flaw allows arbitrary code execution, is listed in CISA KEV with known exploitation, and has a high EPSS percentile, though it requires local delivery and user interaction.

What it is

Apple products contain a memory corruption flaw (out-of-bounds write, CWE-787) in font processing that was fixed through improved input validation. Processing a maliciously crafted font can lead to arbitrary code execution, and the issue affects macOS, iOS, iPadOS and watchOS.

Impact

An attacker who gets a crafted font processed can achieve arbitrary code execution in the context of the affected component, potentially leading to full compromise of the device or application.

Attack surface

The CVSS vector is local (AV:L) with user interaction required (UI:R) and no privileges (PR:N), meaning the victim must open or render a malicious font file or content. No authentication is needed, but the attack is not remotely reachable without local delivery and user action.

Exploitation

CVE-2020-27930 is listed in CISA KEV (added 2021-11-03), indicating known exploitation in the wild, and EPSS shows a 30-day probability of 0.22009 (97.5th percentile). No ransomware campaign use is documented.

What to do

• Apply the Apple security updates listed in the vendor advisories (macOS Big Sur 11.0.1, iOS 14.2/iPadOS 14.2, iOS 12.4.9, watchOS 7.1/6.2.9/5.3.9, Security Update 2020-006 for High Sierra and Mojave, macOS Catalina 10.15.7 updates).
• Prioritize patching internet-facing and user-facing Apple endpoints, since KEV listing confirms active exploitation.
• Restrict or block untrusted font files and font-bearing documents at email and web gateways where feasible.
• Educate users not to open font files or documents from untrusted sources, as user interaction is required.
• Verify patch compliance across all affected Apple platforms, including older macOS and watchOS versions covered by the advisories.

Detection

• Monitor for crashes or abnormal termination in font parsing services and applications (CoreText, font daemons) on Apple endpoints.
• Hunt for suspicious font files (.ttf, .otf, .ttc) delivered via email, web downloads or removable media and correlate with process execution.
• Review endpoint telemetry for code execution spawned from font rendering or document viewer processes.
• Check asset inventories for unpatched macOS, iOS, iPadOS and watchOS versions against the fixed releases.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.