cve-2025-43330: breaking out of a sandbox using font files

tl;dr earlier this year, i discovered that macOS&rsquo;s genatsdb binary (Generate Apple Type Services Databas, i.e. font processing tool) runs without inheriting sandbox restrictions from its parent processes, creating a universal sandbox escape. this was assigned a CVE by Apple. this meant that any sandbox application could execute genatsdb via polyglot files (which, in my PoC, were…