A null pointer dereference in Apple CoreText could be reached by processing web content, leading to a denial of service. Apple addressed it with improved input validation. Fixed in iOS 26.7 and iPadOS 26.7, iOS 27 and iPadOS 27, macOS Golden Gate 27, macOS Sequoia 15.8, macOS Tahoe 26.7, visionOS 27, and watchOS 27, and credited to Pavan Nallamothu in all seven advisories.
Processing web content may lead to a denial-of-service via a null pointer dereference in Apple CoreText.
iOS 27, iPadOS 27, iOS 26.7, iPadOS 26.7, macOS Golden Gate 27, macOS Tahoe 26.7, macOS Sequoia 15.8, watchOS 27, visionOS 27 · released September 14, 2026
cve.org record · Apple security advisories: iOS 27 / iPadOS 27 · macOS Golden Gate 27 · watchOS 27 · visionOS 27 · iOS 26.7 / iPadOS 26.7 · macOS Tahoe 26.7 · macOS Sequoia 15.8