CVE-2026-86950: The Great Glyph Grift - An in-the-wild iOS bug with a possible WhatsApp zero-click path
Apple fixed in-the-wild CoreGraphics CVE-2026-86950 in iOS 26.7.1; crafted PDF fonts can trigger an out-of-bounds write.
Apple fixed CVE-2026-86950 in iOS 26.7.1, a CoreGraphics flaw credited to Meta Product Security. Apple said the bug may have been exploited in an extremely sophisticated attack against specific targeted individuals. Calif's patch analysis describes a coordinate unit-conversion error in anti-aliased path rasterization: a malicious PDF containing a crafted font can undersize an allocation and cause an out-of-bounds write, and the researchers say a proof of concept triggers it on macOS and iOS. Later WhatsApp builds added optional strict PDF validation, including checks of embedded FontFile streams.
- CVE-2026-86950 is a CoreGraphics bug fixed in iOS 26.7.1.
- Apple said it may have been exploited against specific targeted individuals.
- A malicious PDF with a crafted font can cause an out-of-bounds write.
- Calif reports a proof of concept affecting both macOS and iOS.
- WhatsApp added stricter PDF and embedded-font checks after the report.
- Countries
- United States
Coverage
oldest first · one row per article · UTC- · Sep 29, 2026
SecurityWeekFirst report
Apple Patches Meta-Reported Zero-Day Linked to ‘Extremely Sophisticated Attack’
Apple's iOS and macOS updates fix CoreGraphics zero-day CVE-2026-86950, reported by Meta and possibly exploited in targeted attacks on iOS users.
- · Sep 29, 2026
Cyber Security News
Critical Apple Zero-Day Vulnerability Actively Exploited in Attacks
Apple patched actively exploited CoreGraphics zero-day CVE-2026-86950 enabling arbitrary code execution via crafted files in targeted attacks on iOS users.
Vulnerabilities in this story
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2025-24200 | Incorrect Authorization in Apple iOS/iPadOS Lets Attackers Disable USB Restricted Mode | 6.1 | 4% | KEV | KEV |
| CVE-2025-43300 | Actively Exploited Out-of-Bounds Write in Apple iOS/iPadOS/macOS Image I/O | 10.0 | 65% | KEVPoC | KEV |
| CVE-2025-55177 | Incorrect Authorization in WhatsApp Linked-Device Sync Used in Targeted Spyware Attacks | 5.4 | 14% | KEV | KEV |
| CVE-2026-20700 | Exploited Memory Corruption Flaw in Apple iOS, iPadOS, macOS, tvOS, visionOS, watchOS | 7.8 | 2% | KEV | KEV |
| CVE-2026-86869 | Out-of-bounds write in Apple image handling crashes apps | 6.5 | — | ||
| CVE-2026-86950 | Out-of-Bounds Write in Apple CoreGraphics Enables Code Execution on iOS and macOS | 8.8 | 26% | KEVPoC ×3 | KEV |