An out-of-bounds read issue was addressed with improved input validation. This issue is fixed in iOS 27 and iPadOS 27, macOS Golden Gate 27, tvOS 27, visionOS 27, watchOS 27. Processing a maliciously crafted font may result in the disclosure of process memory.
https://support.apple.com/en-us/149038
https://support.apple.com/en-us/149037
https://support.apple.com/en-us/149036