Triangulating TrueType Fonts On macOS: Reconstructing CVE-2023-41990

The talk starts from the Operation Triangulation campaign against iOS devices, where a font embedded in a PDF was reportedly the initial entry point. Public reporting only said it abused an undocumented TrueType bytecode instruction in Apple's font renderer, and no exploit sample was available. Because Apple removed the instruction outright, patch diffing offered nothing, so the vulnerability had to be rediscovered by hand.

The middle of the talk covers how hinted fonts rely on a bytecode interpreter, and why macOS usually skips that interpreter in favour of auto-hinting. The researcher found that two font properties push the renderer onto the slow interpreter path, then inserted the hidden instruction with font tooling and confirmed it could be reached in a debugger. Reverse engineering showed the instruction takes three parameters and walks point arrays that must stay synchronised. A search loop never checks its starting index, so an out-of-bounds index can reach neighbouring memory, though the value written is only partly controllable.

The closing section looks at variant analysis across other undocumented opcodes, and at why a practical detection signature would require parsing the font format in depth. Fuzzers struggle with this code unless they are structure-aware and steered toward the interpreter. The PDF path also accepts fonts whatever type the document declares, which widens the surface a defender should consider.