SECURITY researchers have published the first public proof‑of‑concept for CVE-2026-86950, a CoreGraphics flaw in Apple’s 2D drawing, image rendering and PDF processing library. The PoC shows that a crafted PDF containing an embedded TrueType font can crash unpatched iPhones and Macs, due to a memory‑corruption bug in how glyph coordinates are converted from floating‑point to 32‑bit fixed‑point values.
The researchers emphasise the current code path only yields a crash, not immediate code execution; converting a crash into a reliable exploit would require additional development. Apple remedies this with a September 28 patch, and the firm credits Meta Product Security for the discovery, noting possible use in an “extremely sophisticated attack against specific targeted individuals on versions of iOS before iOS 27.” The U.S.
Cybersecurity and Infrastructure Security Agency subsequently added CVE-2026-86950 to its Known Exploited Vulnerabilities catalog, with federal agencies instructed to apply the update by October 2.
The Calif research team looked at WhatsApp’s handling of PDFs to assess a possible delivery path, comparing WhatsApp versions 26.37.73 and 26.38.74. They observed new code in WhatsApp’s Kaleidoscope attachment scanner that flags certain font streams with high‑risk tags, potentially influencing the parser’s behaviour. While the analysis presents circumstantial evidence linking WhatsApp to a potential delivery vector, it does not confirm an active in‑the‑wild exploit against the messenger app.
Apple has not listed iOS 27 or macOS Golden Gate 27 as affected in its advisories, and no workaround has been described for systems unable to update immediately. The published material includes a GitHub repository with generation scripts and a sample PDF.