An out-of-bounds read was addressed with improved bounds checking. This issue is fixed in iOS 27 and iPadOS 27, macOS Golden Gate 27, tvOS 27, visionOS 27, watchOS 27. Processing a maliciously crafted font may result in the disclosure of process memory.
https://support.apple.com/en-us/149038
https://support.apple.com/en-us/149037
https://support.apple.com/en-us/149036