Safety researchers have revealed the primary public proof-of-concept for CVE-2026-86950, an Apple CoreGraphics flaw Apple says might have been utilized in assaults in opposition to particular focused people.
The set off is a malicious PDF with a crafted embedded font that crashes unpatched iPhones and Macs. The code causes a crash, not an execution error. Turning the reminiscence corruption right into a working exploit is separate work the evaluation doesn’t show.
Apple patched the flaw on September 28, crediting Meta Product Safety with the invention and noting it might have been utilized in an “extraordinarily subtle assault in opposition to particular focused people on variations of iOS earlier than iOS 27.”
The U.S. Cybersecurity and Infrastructure Safety Company added the flaw to its Identified Exploited Vulnerabilities catalog the next day, requiring federal companies to use the repair by October 2.
Apple has not listed iOS 27 or macOS Golden Gate 27 as affected within the September 28 advisories. No workaround has been described for programs that can’t replace instantly.
What the Researchers Discovered
The evaluation was revealed September 30 by Dion Blazakis, Josh Maine, and Anna Groza of Calif, a agency identified for analysis into zero-click assault surfaces in messaging apps. They began from a publicly obtainable binary comparability of iOS 26.7 and 26.7.1.
CoreGraphics is the Apple framework for 2D drawing, picture rendering, and PDF processing. It was the one library modified in 26.7.1, with the identical repair utilized greater than 20 instances throughout eight rasterizer features.
The patched code converts a glyph coordinate from floating-point to a 32-bit fixed-point worth. Earlier than the patch, two of the eight features dealt with out-of-range values in a different way: one saturated the end result, the opposite truncated it.
That distinction brought on the calculated bounding field for a glyph to be too slender. CoreGraphics then allotted a working buffer smaller than the perimeters it wanted to attract, and wrote outdoors it.
To set off the bug, the researchers constructed a TrueType font with coordinates giant sufficient to power the overflow. Embedding it in a PDF with a textual content matrix and nested composite-glyph scaling pushes these coordinates previous the restrict. They revealed the technology scripts and a pattern PDF in a public GitHub repository.
The harness calls the identical ImageIO thumbnail path an app makes use of when previewing a acquired attachment. The researchers say the crash happens on each macOS and iOS.
The macOS end result features a full debugger name stack. The iOS declare is Calif’s, with no separate hint revealed.
The crash exposes a managed out-of-bounds write that impacts two adjoining 16-bit values in a buffer that the attacker can management, permitting writes to the stack or heap. Calif says changing that primitive into working code execution is separate work. Calif didn’t receive the in-the-wild pattern and can’t say how the attacker accomplished the chain.
The WhatsApp Query
Calif examined WhatsApp as a result of Meta Product Safety was credited with discovering the flaw. The agency in contrast two latest WhatsApp variations, 26.37.73 and 26.38.74, and located new code in WhatsApp’s Kaleidoscope attachment scanner.
The newer model reads PDF information for embedded font streams and flags suspicious ones with three defect tags: MalformedFontProgram, UndecodableFontProgram, and UnverifiedFontProgram. Any such tag returns a high-risk rating to WhatsApp’s attachment checker, which then stops automated parsing of the flagged file.
Calif described these modifications as circumstantial proof pointing towards WhatsApp as a potential supply vector. The agency’s submit describes its analysis as protecting a potential WhatsApp zero-click path.
The revealed evaluation doesn’t describe or take a look at a WhatsApp supply path. The preliminary model did: it mentioned the researchers’ evaluation instructed WhatsApp might ship a PDF that triggers the flaw when a sufferer opens a chat from a trusted contact with automated media downloads on.
That sentence was eliminated 85 minutes after publication in a commit by Calif CEO Thai Duong, who described the change as eradicating the WhatsApp hypothesis.
The evaluation closes with a query: whether or not the flaw “was mixed with further vulnerabilities in WhatsApp to succeed in parsing with much less person interplay.” That phrasing suggests the trail Calif studied would require person motion or additional WhatsApp vulnerabilities within the chain.
WhatsApp has revealed no advisory linking this flaw to its merchandise. Its 2026 advisory web page lists two unrelated vulnerabilities.
The Hacker Information requested Meta whether or not WhatsApp was concerned within the reported assaults. Meta didn’t reply earlier than publication.
An earlier case makes the speculation believable. In August 2025, WhatsApp assessed {that a} flaw in its linked-device synchronization messages might have been mixed with a separate Apple out-of-bounds write and used in opposition to fewer than 200 focused customers, a pair of vulnerabilities THN lined on the time.
The Hacker Information requested Calif in regards to the eliminated supply declare and whether or not the researchers had obtained the in-the-wild pattern since publication. Calif didn’t reply earlier than publication.
No community indicators, attacker identifiers, or exploit payload names have been made public. Apple has not mentioned whether or not Lockdown Mode would have blocked the supply path used within the reported assaults.
