An out-of-bounds read was addressed with improved input validation. This issue is fixed in Security Update 2021-002 Catalina, Security Update 2021-003 Mojave, iOS 14.5 and iPadOS 14.5, watchOS 7.4, tvOS 14.5, macOS Big Sur 11.3. Processing a maliciously crafted font file may lead to arbitrary code execution.
https://support.apple.com/en-us/HT212327
https://support.apple.com/en-us/HT212326
https://support.apple.com/en-us/HT212325
https://support.apple.com/en-us/HT212324