Apple has released a security update for macOS Sequoia 15.7.1 to address a serious vulnerability in its font parser.
The flaw, tracked as CVE-2025-43400, allows a maliciously crafted font file to trigger an out-of-bounds write.
Exploitation could cause unexpected application crashes or corrupt process memory on affected systems.
Apple patched this issue on September 29, 2025, as part of its Sequoia 15.7.1 update. While there are no reports of active exploitation, the vulnerability could be combined with other bugs to achieve remote code execution.
In line with Apple’s standard practice, details about this and other fixes are documented in the “Security Content of macOS Sequoia 15.7.1” document.
Apple discloses vulnerabilities by CVE identifier once patches are available. Users are advised to apply the update promptly to protect their systems.
Security content is also available for iOS, iPadOS, visionOS, and earlier macOS releases. The following table summarizes all platforms that received the CVE-2025-43400 fix.
| CVE ID | Platforms Affected | Impact |
|---|---|---|
| CVE-2025-43400 | iOS 26.0.1; iPadOS 26.0.1; iOS 18.7.1; iPadOS 18.7.1; macOS Tahoe 26.0.1; macOS Sequoia 15.7.1; macOS Sonoma 14.8.1; visionOS 26.0.1 | Unexpected app termination or corrupt process memory via malicious font |
Apple has not indicated any need for user action beyond installing the updates. Devices set to update automatically will receive the patch in the next cycle.
Those with manual updates enabled should navigate to System Settings > General > Software Update to download and install macOS Sequoia 15.7.1.
For developers and security teams, Apple’s official security releases page maintains a complete list of recent patches and their CVE references.
This vulnerability underscores the need for vigilance when handling font files from untrusted sources.
Even seemingly benign fonts can harbor code designed to exploit parsing bugs, potentially leading to data corruption or broader system compromise.
By promptly applying the Sequoia 15.7.1 update, macOS users close off this attack vector. Organizations should verify their update policies and ensure all endpoints, including mobile and mixed-OS fleets, are protected against CVE-2025-43400.
Follow us on Google News, LinkedIn, and X to Get Instant Updates and Set GBH as a Preferred Source in Google.
Attackers abused compromised ConnectWise Cloud Backup credentials to access Microsoft 365 customer environments, prompting ConnectWise…
Anthropic says an internal Claude research model reconstructed how the National Security Agency generated seeds…
Two WordPress Core vulnerabilities can be chained to execute remote code without authentication, according to…
A newly disclosed OpenBSD kernel exploitation chain combines a shared memory accounting flaw with a…
GhostAction attackers have expanded their GitHub credential theft campaign with a second stage that disguises…
Indian authorities have warned that SideCopy hackers are targeting Indian organizations, including academic institutions, with…