# CVE-2020-27930: Safari RCE in Type 1 fonts handled by libType1Scaler.dylib

Negative argument count to callothersubr in Safari's Type 1 font interpreter shifts the operand stack pointer out of bounds, giving arbitrary read/write and RCE.

- Payout: Real-world hack
- Severity: high
- Program: Apple Safari
- Credited: Mateusz Jurczyk and Sergei Glazunov, Project Zero (Originally posted on [Project Zero blog](https://googleprojectzero.blogspot.com/p/rca.html) 2021-02-04)
- Disclosed: 2020-11-05
- CVE: CVE-2020-27930
- Write-up quality: 8/10
- Original: https://github.com/googleprojectzero/0days-in-the-wild/blob/main/0day-RCAs/2020/CVE-2020-27930.md
- Library page: https://bugbountylibrary.com/r/p0%3ACVE-2020-27930
- Tags: domain:browser domain:desktop impact:integrity impact:rce kind:incident platform:project-zero sev:high tech:ios technique:chained technique:reverse-engineering technique:source-review vuln:memory-corruption vuln:rce

**Target:** Type 1 PostScript font CharString interpreter (libType1Scaler.dylib) reachable via Safari
**Root cause:** DoType1InterpretCharString pops a user-controlled argument count n and does op_sp -= n, checking only the lower bound of the stack; a negative n moves op_sp past the top of the stack into the native frame.
**Steps:**
1. Craft a Type 1 font with a CharString containing `arg_1 ... arg_n n othersubr# callothersubr` where n is negative and othersubr# is non-standard.
2. Load the font in Safari so libType1Scaler.dylib's DoType1InterpretCharString interprets it.
3. Interpreter executes `int n = POP(); op_sp -= n;` with negative n, moving op_sp above &op_stk[63].
4. Use CharString arithmetic/conditional operators to read and write the native stack frame (return addresses, pointers).
5. Build a ROP chain on the stack or otherwise redirect control flow to execute arbitrary code.
**How found:** Authors assess it was likely found via reverse engineering and manual code audit of the self-contained CharString interpreter, where pointer arithmetic issues are easy to spot manually but hard to fuzz; possibly recognized as a variant of prior BLEND bugs in Microsoft/Adobe Type 1 engines.
**Exploitation:** Delivered as the Safari RCE stage of an iOS exploit chain; the OOB stack pointer grants access to return addresses and pointers, enabling an arbitrary read/write primitive and ROP chain construction for code execution. Full exploit flow noted as still under analysis.
**Escalation:** Chained with kernel info leak CVE-2020-27950 and kernel privilege escalation CVE-2020-27932 in a full iOS exploit chain.
**Insight:** Legacy Type 1 font interpreters share a 1990s codebase across Apple/Microsoft/Adobe; audit stack-pointer arithmetic in callothersubr/othersubr handlers for missing upper-bound checks on negative counts, and treat any Type 1 font on a website as highly suspicious since browsers don't officially support the format.