CVE-2020-27930

What is Apple's FontParser?

FontParser is the system component across iOS, iPadOS, macOS, and watchOS responsible for interpreting font files, used any time the OS renders text — including text embedded in documents, web pages, or messages a user opens without any indication a font is even involved. Font parsers across every major OS have a long history of memory-corruption vulnerabilities, because font file formats are complex binary structures parsed by native code that frequently processes attacker-supplied data with minimal user awareness.

Overview

CVE-2020-27930 is a memory corruption vulnerability (CWE-787) in FontParser that can lead to code execution when a device processes a maliciously crafted font (CVSS 3.1: AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, 7.8 High). Apple patched it alongside two related vulnerabilities — CVE-2020-27932 (a kernel type confusion bug, also enriched on this site) and CVE-2020-27950 (a kernel memory disclosure issue) — in November 2020, explicitly noting reports that all three "may have been actively exploited."

Technical Details

A maliciously crafted font file, when parsed by the vulnerable FontParser code, triggers a memory corruption condition that an attacker can leverage for code execution. On its own, this typically requires some form of user interaction (opening a document or message containing the malicious font) and initial code execution occurs within whatever process parsed the font — which is where the two companion kernel vulnerabilities in this same patch batch come in, providing the privilege escalation needed to turn initial code execution into a full device compromise.

Discovery

Reported to Apple by Clément Lecigne and Sergei Glazunov of Google's Threat Analysis Group / Project Zero, credited in Apple's advisory alongside the two companion CVEs.

Exploitation Context

Apple's own security advisory for this release stated Apple was "aware of a report that this issue may have been actively exploited" — a rare direct acknowledgment from Apple, typically reserved for vulnerabilities under genuine real-world attack rather than proactively-discovered research findings. The three-CVE cluster (this font-parsing RCE plus two kernel-level bugs) matches the standard architecture of a complete mobile exploitation chain: initial code execution via a malicious file, then privilege escalation to break out of the app/process sandbox.

Remediation

1. Update iOS, iPadOS, macOS, and watchOS to the version that includes this fix (and the two companion CVEs) or later — this is not optional given Apple's own acknowledgment of active exploitation.
2. Enable automatic OS updates on all Apple devices in your environment to minimize the window between patch availability and installation.
3. Be cautious opening documents, messages, or files from unknown or unverified senders, since font-parsing exploitation typically requires the victim to open or view attacker-controlled content.
4. Treat any Apple device that remained unpatched for an extended period after November 2020 as a candidate for compromise assessment, given the confirmed active-exploitation status of this vulnerability cluster.